Nov 2017 Campaigns

11/1/2017,Malicious email campaign; morning,"Invoice"; doc -> lqtloader -> locky ransomware",Attachment,296
11/1/2017,Malicious email campaign; morning,"UPS Ship Notification; Tracking Number <digits>"; doc -> emotet banking trojan",Link,14
11/1/2017,Malicious email campaign; morning,"Emailing: <characters> - 01.11.2017"; doc -> qtloader -> locky ransomware; continued into 11/2/2017",Attachment,1533
11/1/2017,Malicious email campaign; morning,"New incoming Fax from <digits>"; link -> doc -> hancitor -> pony -> evilpony -> pandabanker trojans",Link,814
11/2/2017,Malicious email campaign; morning,"<digits>_Invoice_<digits>"; doc -> qtloader -> locky ransomware; continued into 11/3/2017",Attachment,872
11/3/2017,Malicious email campaign; morning,"attachment is subject"; doc -> qtloader -> locky ransomware",Attachment,265
11/3/2017,Malicious email campaign; morning,"Scanned image from MX-2600N"; doc -> qtloader -> locky ransomware",Attachment,322
11/3/2017,Malicious email campaign; afternoon,"You have received a fax message"; doc -> trickbot",Attachment,14
11/6/2017,Malicious email campaign; morning,"E3S<digits> Payment advice"; doc -> qtloader -> locky ransomware; continued into 11/7/2017",Attachment,1810
11/6/2017,Malicious email campaign; morning,"Delivery failed"; link -> doc -> hancitor -> pony -> evilpony -> pandabanker trojans",Link,329
11/7/2017,Malicious email campaign; morning,"Invoice #<digits>"; doc -> -> locky ransomware",Attachment,495
11/7/2017,Phishing email; morning,"Follow up"; phishing; amgsales.net appears to be hacked",Link,11
11/7/2017,Malicious email campaign; morning,"Invoice issue"/"Invoice problem"; doc  -> emotet banking trojan",Link to Doc Download,6
11/7/2017,Malicious email campaign; morning,"Delivery failed|You have received a new document from <user@yourdomain>"; link -> doc -> hancitor -> pony -> evilpony -> pandabanker trojans",Link,633
11/7/2017,Malicious email campaign; morning,"Emailing: <characters> - 07.11.2017"; doc -> locky ransomware; continued into 11/8/2017",Attachment,841
11/8/2017,Malicious email campaign; morning,"Invoice <characters>"; doc -> locky ransomware",Attachment,485
11/8/2017,Malicious email campaign; morning,"RE: iPhone X pre-order"; link -> doc -> hancitor -> pony -> evilpony -> pandabanker trojans",Link,483
11/9/2017,Malicious email campaign; morning,"Scanned from <printer brand>"; doc -> locky ransomware",Attachment,236
11/9/2017,Malicious email campaign; morning,"Re: Past due invoice "; link -> doc -> hancitor -> pony -> evilpony -> pandabanker trojans",Link,869
11/9/2017,Malicious email campaign; afternoon,"Invoice|Receipt|Scanned document"; doc -> locky ransomware; continued into 11/10/2017",Attachment,360
11/13/2017,Malicious email campaign; morning,"UPS Ship Notification; Tracking Number <digits>"; doc -> emotet banking trojan",Attachment,27
11/13/2017,Malicious email campaign; morning,"<digits> has faxed you a document."; link -> doc -> hancitor -> pony -> evilpony -> pandabanker trojans",Attachment,1200
11/14/2017,Malicious email campaign; morning,"Your Office 365 Business billing statement for <domain> is available."; link -> doc -> hancitor -> pony -> evilpony -> pandabanker trojans",Link,677
11/14/2017,Malicious email campaign; morning,"Emailling: <digits>.doc"; doc -> trickbot",Attachment,81
11/14/2017,Malicious email campaign; morning,"PayPal"; doc -> trickbot",Attachment,49
11/15/2017,Malicious email campaign; morning,"New fax from <digits> for <user@domain>"; ; link -> doc -> hancitor -> pony -> evilpony -> zloader trojans",Link,690
11/15/2017,Malicious email campaign; morning,"Top Urgent!!!"; zip -> exe -> securityexploded info stealer",Attachment,5
11/15/2017,Malicious email campaign; morning,"Invoice No. <digits>"; doc -> exe -> dridex banking trojan",Attachment,17
11/16/2017,Malicious email campaign; morning,"Your Legally Binding Contract document is ready for signature!"; link -> doc -> hancitor -> pony -> evilpony -> pandabanker trojans",Link,490
11/20/2017,Malicious email; morning,"THANKSGIVING INVENTORY LIST"; doc -> exe -> netwire",Attachment,1
11/20/2017,Malicious email campaign,"Multiple subjects all include "invoice"; doc/link -> exe -> emotet",Attachment/Link,
11/21/2017,Malicious email campaign; morning,"Your confirmation for HoldMail Service request"; link -> doc -> hancitor -> pony -> evilpony -> icedid trojans",Link,243
11/27/2017,Malicious email campaign; morning,"<user@domain> accounting statements"; link -> doc -> hancitor -> pony -> evilpony -> icedid trojans",Link,910
11/28/2017,Malicious email campaign; morning,"<digits> has faxed you a document"; link -> doc -> hancitor -> pony -> evilpony -> pandabanker trojans",Link,849
11/29/2017,Malicious email campaign; morning,"Your Monthly Statement document is ready for signature!"; link -> doc -> hancitor -> pony -> evilpony -> pandabanker trojans",Link,637
11/29/2017,Malicious email campaign; morning,"Job Order # 02110760"; link -> zip -> ifsb/dreambot trojan",Link,45
11/30/2017,Malicious email campaign; morning,"Emailing - <digits>|FL-<digits> 11.30.2017"; 7z -> vbs -> globeimposter ransomware",Attachment,2561
11/30/2017,Malicious email campaign; morning,"Fwd: SHIPPING DOCUMENTS - RE: 1756047 / DRAFT DOC-BILL OF LADING NO. AEL069370"; rar -> backconnect rat",Attachment,4
11/30/2017,Malicious email campaign; morning,"All subjects contain "fatt|fattura"; xls -> exe  -> smokeloader -> pandabanker",Attachment,5