SHARE
TWEET

2019-02-14 - Malspam using password-protected Word docs

malware_traffic Feb 14th, 2019 (edited) 2,051 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2019-02-14: MALSPAM USING PASSWORD-PROTECTED WORD DOCS PUSHES ICEDID (BOKBOT)
  2.  
  3. PASSWORD-PROTECTED WORD DOC (PASSWORD: 1234)
  4.  
  5. - SHA256 hash: 1710e5ad307bdaddae372274bfe81a431009e38bd51039216977b593f546e393
  6. - File size: 37,888 bytes
  7. - File name: Candance Pettengill Resume.doc
  8.  
  9. FOLLOW-UP MALWARE (ICEDID, AKA: BOKBOT)
  10.  
  11. - SHA256 hash: 6d3546c0374ec3b83f4ec2e9d9573a8e70fcef8230d5960306560e9c2f3b4db6
  12. - File size: 126,976 bytes
  13. - File location: hxxp://209.141.55[.]226\troll1.jpg
  14. - File location: C:\Users\[username]\AppData\Local\Temp\qwerty2.exe
  15. - Any.Run analysis: https://app.any.run/tasks/7fea63da-4a2c-4086-af19-8df3c13933fb
  16. - CAPE sandbox: https://cape.contextis.com/analysis/37085/
  17. - Reverse.it: https://www.reverse.it/sample/6d3546c0374ec3b83f4ec2e9d9573a8e70fcef8230d5960306560e9c2f3b4db6
  18.  
  19. 47 EXAMPLES FROM APPROX 400 FOUND SO FAR ON 2019-02-14 (ALL ATTACHMENT SIZES 37,888 BYTES):
  20.  
  21. - Sender: ajohanns@cox.net -- Subject: Hiring -- Attachment name: Dominga Adkinson Resume.doc
  22. - Sender: aliciajnelson@cox.net -- Subject: Regarding Job -- Attachment name: Shaquita Schaffner Resume.doc
  23. - Sender: andersonchad@cox.net -- Subject: Regarding Job -- Attachment name: Matha Thrasher Resume.doc
  24. - Sender: antonio5240@cox.net -- Subject: Hiring -- Attachment name: Randolph Nelsen Resume.doc
  25. - Sender: aroyal1955a@cox.net -- Subject: Job Application -- Attachment name: Dominga Adkinson Resume.doc
  26. - Sender: aroyal1955a@cox.net -- Subject: Regarding Job -- Attachment name: Dominga Adkinson Resume.doc
  27. - Sender: bafrank1971@cox.net -- Subject: application -- Attachment name: Matha Thrasher Resume.doc
  28. - Sender: bograham@cox.net -- Subject: Job -- Attachment name: Marhta Sessler Resume.doc
  29. - Sender: cameron2@cox.net -- Subject: Regarding position -- Attachment name: Doyle Bruce Resume.doc
  30. - Sender: carnold135@cox.net -- Subject: Regarding Job -- Attachment name: Klara Mauger Resume.doc
  31. - Sender: carrskpp@cox.net -- Subject: Job -- Attachment name: Angie Pirkle Resume.doc
  32. - Sender: carrskpp@cox.net -- Subject: Regarding position -- Attachment name: Elias Baskerville Resume.doc
  33. - Sender: cattwoman@cox.net -- Subject: application -- Attachment name: Shona Dyck Resume.doc
  34. - Sender: christianyrle@cox.net -- Subject: application -- Attachment name: Alona Mcferren Resume.doc
  35. - Sender: christianyrle@cox.net -- Subject: Job -- Attachment name: Alona Mcferren Resume.doc
  36. - Sender: cmelerine2@cox.net -- Subject: Regarding Job -- Attachment name: Tam Skipworth Resume.doc
  37. - Sender: cpcrawford@cox.net -- Subject: Hiring -- Attachment name: Vicky Linsey Resume.doc
  38. - Sender: djbolduc@cox.net -- Subject: Regarding Job -- Attachment name: Dennis Cadet Resume.doc
  39. - Sender: dloveall2@cox.net -- Subject: Regarding position -- Attachment name: Mittie Rieder Resume.doc
  40. - Sender: dmauricio2000@cox.net -- Subject: Hiring -- Attachment name: Homer Agtarap Resume.doc
  41. - Sender: drezac@cox.net -- Subject: Regarding Job -- Attachment name: Clementina Liebig Resume.doc
  42. - Sender: dsweetchic@cox.net -- Subject: Job Application -- Attachment name: Dennis Cadet Resume.doc
  43. - Sender: howieb@cox.net -- Subject: Job Application -- Attachment name: Shaquita Schaffner Resume.doc
  44. - Sender: hypervolt1@cox.net -- Subject: Regarding Job -- Attachment name: Alona Mcferren Resume.doc
  45. - Sender: james702@cox.net -- Subject: application -- Attachment name: Evie Small Resume.doc
  46. - Sender: menwiller1@cox.net -- Subject: Regarding Job -- Attachment name: Tricia Cogswell Resume.doc
  47. - Sender: mitzysam@cox.net -- Subject: Job Application -- Attachment name: Lavera Muck Resume.doc
  48. - Sender: mitzysam@cox.net -- Subject: Regarding position -- Attachment name: Lavera Muck Resume.doc
  49. - Sender: moreno2@cox.net -- Subject: Job Application -- Attachment name: Klara Mauger Resume.doc
  50. - Sender: nttengan@cox.net -- Subject: Regarding Job -- Attachment name: Livia Westlake Resume.doc
  51. - Sender: payurboy@cox.net -- Subject: Hiring -- Attachment name: September Gleaves Resume.doc
  52. - Sender: payurboy@cox.net -- Subject: Job -- Attachment name: September Gleaves Resume.doc
  53. - Sender: payurboy@cox.net -- Subject: Regarding position -- Attachment name: September Gleaves Resume.doc
  54. - Sender: pconary@cox.net -- Subject: Job Application -- Attachment name: Lavera Muck Resume.doc
  55. - Sender: sak9019@cox.net -- Subject: Regarding Job -- Attachment name: Kylee Chiles Resume.doc
  56. - Sender: sctaranto@cox.net -- Subject: application -- Attachment name: Troy Almaguer Resume.doc
  57. - Sender: stkrsk@cox.net -- Subject: application -- Attachment name: Jacque Francoeur Resume.doc
  58. - Sender: sunset100@cox.net -- Subject: Job Application -- Attachment name: Kasey Rohloff Resume.doc
  59. - Sender: susanwebb@cox.net -- Subject: Hiring -- Attachment name: Shizue Fegan Resume.doc
  60. - Sender: swaszak@cox.net -- Subject: Regarding position -- Attachment name: Matha Thrasher Resume.doc
  61. - Sender: tferruzzo@cox.net -- Subject: Hiring -- Attachment name: Estelle Sharon Resume.doc
  62. - Sender: tgilder@cox.net -- Subject: Job Application -- Attachment name: Mozelle Kalinowski Resume.doc
  63. - Sender: truoc@cox.net -- Subject: Regarding Job -- Attachment name: Livia Westlake Resume.doc
  64. - Sender: vloredo@cox.net -- Subject: application -- Attachment name: Vicky Linsey Resume.doc
  65. - Sender: wolfwin12@cox.net -- Subject: Regarding Job -- Attachment name: Shona Dyck Resume.doc
  66. - Sender: worthyishe8@cox.net -- Subject: Regarding Job -- Attachment name: Kylee Chiles Resume.doc
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top