Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 2016-11-09 #locky email phishing campaign "Fuel Card E-bill"
- Email sample:
- ---------------------------------------------------------------------------------------------------------------
- From: "ADELINE WILLETT" <adeline.willett@kapraeyc.com>
- To: [REDACTED]
- Subject: Shell Fuel Card E-bill 910934 for Account (rnd(B, S, F, H, A, D, C, N, M, L)}}920433 08/11/2016
- Date: Wed, 09 Nov 2016 18:11:30 +0530
- ADELINE WILLETT
- Last & Tricker Partnership
- 3 Lower Brook Mews
- Lower Brook Street
- Ipswich Suffolk IP4 1RA
- T: 01473 252961 F: 01473 233709 M: 07778464004
- email: adeline.willett@kapraeyc.com
- This e-mail and any attachments may contain confidential and privileged
- information and is intended only for the use of the individual or entity to
- which it is addressed. If you are not the intended recipient, please notify
- the sender immediately by return e-mail, delete this e-mail and destroy any
- copies from your system; you should not copy the message or disclose its
- contents to anyone. Any dissemination, distribution or use of this
- information by a person other than the intended recipient is unauthorized
- and may be illegal. We cannot accept liability for any damage sustained as a
- result of software viruses and advise you to carry out your own virus checks
- before opening any attachment.
- Attachment: ebill910934.zip
- ---------------------------------------------------------------------------------------------------------------
- - sender varies between emails
- - subject is "<BP|Shell> Fuel Card E-bill <number> for Account (rnd(B, S, F, H, A, D, C, N, M, L)}}920433 08/11/2016"
- - attached file "ebill<number>.zip" contains file "<2 digits><2-7 letters><8 digits>.wsf", a JScript downloader
- The URLs, malware etc ... are same as for campaign "Message from KMBT_C220" http://pastebin.com/aYyBzU0U
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement