malware_traffic

2020-07-08 - Trickbot gtag chil61 from XLS macros

Jul 8th, 2020
1,108
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2020-07-08 - COVID OR IRS-THEMED MALSPAM USING XLS SPREADSHEET MACROS TO PUSH TRICKBOT GTAG CHIL61
  2.  
  3. REFERENCES:
  4.  
  5. - https://twitter.com/abuse_ch/status/1280578303171100678
  6. - https://twitter.com/abuse_ch/status/1280739909133836288
  7.  
  8. SHA256 HASHES AND FILE NAMES:
  9.  
  10. - NOTE: Creation dates for these XLS spreadsheets are all listed 2020-07-02:
  11.  
  12. - 141691c3e19b94306d6ccb96eb9ac7a147b23a091527256cc04a3303fdc6f50a Base_COVID-19.xls
  13. - 29d16f5611f3d08cf4df70807b7bc6b838667fe3f5258c61838719bd6d76c013 Form_coronavirus_Covid-19.xls
  14. - 451aae69a290dcb371bb8159409e21b54c620e83c1d67369794ebb958a194584 Base_covid-19.xls
  15. - 771bc37ae06f0bdc092f28507f1c629bb9e976065367de20d6f96a70bd174e44 Base_covid-19.xls
  16. - 7baa34e9a6a8234ce47c0ac65f9e661ada3e317c49038678ffb2e215f7818e6c Base_Covid-19.xls
  17.  
  18. - 07fb7deeb15f98d0058330eb6e7d46ca5a97abfc0f5c3b2833ed8819a783aa76 Sheet_2920834.xls
  19. - 08f2383668a39e569a49a6eea5c09535f0fd173efafce0ed67bc1973b2314267 IRS_1243383.xls
  20. - 0acdccba3b7aaa3b0f4398f207d5ed0329ce6556a7f0ca20737d7bc12d2724c3 IRS_Sheet_5996749.xls
  21. - a5ff0973010a5f0e4878f9da26aed03c8f00ce4bba85bdc050fa237165679c29 Tax_1834635.xls
  22. - 29ae5f27132ea8a5225a3d94d045986c6069d57414d5b5e5d59c0e9a4fdd9f01 W2_tax.xls
  23. - 2cd576973649096b2fc516e4a38e795a97f7badfda1f79b5936960eaf8975df9 IRS_Sheet_5994371.xls
  24. - 472732e4e8185056bd820d40fbab6be8f310a0d86c97c635968808b7da210776 IRS_4681393.xls
  25. - 4771bbb1ebb2db87838b8d27bbd94ee2819fc3ceb0d6c32967b5d10b8597c8eb W2_form.xls
  26. - 7297cd4dfb810c66bee44849701c697405e3fd64adee1989dcb66789ffba7e35 IRS_Tax_5522181.xls
  27. - 7ade4c43fe95e92dca2d081b3e9ddc8117e829560c8c5803c38858ae5a8d4903 Form_1099_5831674.xls
  28. - 483891856f43df63a885ff3291dd956e8070a68077890f2ab279699c61183cd6 W2_form.xls
  29. - 75deb4ec4bfda2b44eb5afffc5f4bbddb1e2ed6ba90148567a57fef2a8b12080 Form_1099_6696386.xls
  30. - 8545b15f9227fff6626fec6fa558eef03e8aa2aa5dc8f59f19ca1b9ae02f0db2 IRS_Page_5942590.xls
  31. - 9126bcdd63ff19638c4505848f22c4776b7475db794c9c472010cfa7302b399d IRS_form_5582265.xls
  32. - 9f7a749a729208a968eff0ae2534b0500862b053ac685356ddef06a0265674ed W2_tax.xls
  33. - a5ff0973010a5f0e4878f9da26aed03c8f00ce4bba85bdc050fa237165679c29 Tax_1834635.xls
  34. - b13fc4d81152548748887b9efe6dd5a20421042a3b65f4a387109be177620e5c Form_1099_4413039.xls
  35. - b70d3518a8ad2e5e49b874642012d80ff9570a52541290510a60fc06d2439ffd W2_sheets.xls
  36. - c158c7dcd08b2369ef3eb1f782a9cb9bd9d0b63895854d9e543dcb61add33158 IRS_form_1633293.xls
  37. - c34abd7230748b5d70d0b2565dd2ffbfc7f23a5f4d95f489258b660f5b28797f Form_1099_8850408.xls
  38. - ccbdae077993172c7240b02e5685db8a2e638822332fe20c8608d1690c220909 Tax_7280780.xls
  39. - d3fe0fb29b7bc79908ff52b288d5298a2e2465842e3b1a17a5d8ab2a351efaa2 Tax_70448494850062.xls
  40. - d62c3ac2168b4ab031ae995537a3d47f5bc4d575bbfc56c4207d069e3db038d2 IRS_5388812.xls
  41. - e596e24a08607b4dbfa6b395b546caa6f316921a0088d56354c9734599b73397 Form_1099_3532210.xls
RAW Paste Data