Author Archives: Myonlinesecurity

eFax message from “8473365403” – 1 page(s), Caller-ID: 44-020-3136-4931 malspam delivers Trickbot banking Trojan

Posted on by

The 2nd in today’s Trickbot malspams is an email with the subject of eFax message from “8473365403” – 1 page(s), Caller-ID: 44-020-3136-4931     pretending to come from eFax  but actually coming from a look-a-like domain <message@efax-download.com> with a malicious word doc attachment  is today’s latest spoof of a well known company, bank … Continue reading → Continue reading eFax message from “8473365403” – 1 page(s), Caller-ID: 44-020-3136-4931 malspam delivers Trickbot banking Trojan→

FIRST BANK OF NIGERIA PLC 419 scam, REV MICHEAL GODWIN, FUND TRANSFER FOR YOU

Posted on by

The 419 scams keep coming and every once in a while the odd one springs out as worth mentioning for some reason or another. The idea of a “Good Christian ” reverend being the bank director just appealed to my sense of humour. I know some of my viewers like … Continue reading → Continue reading FIRST BANK OF NIGERIA PLC 419 scam, REV MICHEAL GODWIN, FUND TRANSFER FOR YOU→

Trickbot via VBS files various subjects and a fake flashplayer from pastebin adverts

Posted on by

This morning’s first Trickbot banking Trojan campaign comes in an email with varying subjects including paper doc scan invoice documents Scanned Document receipt order They are all coming from random girls names at random email addresses There is a zip attachment containing a VBS file couple of examples: https://www.virustotal.com/en/file/5d6a5aed0b40512e7a94ae2905c6097e5b59a254f52074f8f2278a2d86c3bdad/analysis/1500545823/ https://www.virustotal.com/en/file/05e9e26f647fd9ee28aa96f876c794c95a7ee386dbba0679cd13145e2f1ffa74/analysis/1500543815/ … Continue reading → Continue reading Trickbot via VBS files various subjects and a fake flashplayer from pastebin adverts→

Spoofed Royal Bank of Scotland IMPORTANT : Advice of Service Charge malspam delivers trickbot

Posted on by

Trickbot are being very busy today. This is the 4th version, which is very different to the previous 3. At least I think it is Trickbot. The email delivery & registration matches recent Trickbot actors, but the actual malware delivery is very different An email with the subject of IMPORTANT … Continue reading → Continue reading Spoofed Royal Bank of Scotland IMPORTANT : Advice of Service Charge malspam delivers trickbot→

Spoofed RFQ Quotation from Sino Heavy Machinery Co Ltd delivers java adwind

Posted on by

We are seeing a bit of an uptick of emails containing java adwind or Java Jacksbot attachments. They are never well detected but recent ones are getting very poor detections by antiviruses. Luckily the malware bad actors sending these still haven’t realised that Outlook and many other email clients block … Continue reading → Continue reading Spoofed RFQ Quotation from Sino Heavy Machinery Co Ltd delivers java adwind→

multiple campaigns delivering Trickbot banking Trojan

Posted on by

Continuing with the latest series of emails with pdf attachments that drops a malicious macro enabled word doc that delivers Trickbot banking Trojan So far today we have seen 3 different campaigns  and subjects all eventually leading to the same Trickbot payload The 1st spoofing true-telecom.com 2nd spoofing Apple 3rd Spoofing … Continue reading → Continue reading multiple campaigns delivering Trickbot banking Trojan→

Trickbot downloaded via VBS. email blank subject noreply@

Posted on by

Just starting to see the second run of today’s Trickbot downloaders coming in. Same sites and payload as the earlier run. This later one comes from noreply@random email addresses. ( all spoofed)  Has a blank subject line and a zip attachment containing a VBS file One of the email looks … Continue reading → Continue reading Trickbot downloaded via VBS. email blank subject noreply@→

Spoofed UK Fuels Collection malspam delivers malware, possibly Trickbot

Posted on by

An email with the subject of UK Fuels Collection  pretending to come from invoices@ebillinvoice.com  with a malicious word doc  attachment  delivers some sort of malware. I am not sure what these are. They might be Jaff ransomware or might be Dridex banking Trojan or Trickbot banking Trojan. The last time I saw … Continue reading → Continue reading Spoofed UK Fuels Collection malspam delivers malware, possibly Trickbot→

fake swift copy notification payment slip malspam with an ACE attachment delivers malware and a jrat Trojan

Posted on by

Continuing with the never ending series of malware email attachments  is an email with the subject of payment slip coming or pretending to come from random companies, names and email addresses with an ACE   attachment ( ACE files are a sort of zip file that normally needs special software to extract. Windows … Continue reading → Continue reading fake swift copy notification payment slip malspam with an ACE attachment delivers malware and a jrat Trojan→

fake swift copy notification payment slip malspam with an ACE attachment delivers malware and a jrat Trojan

Posted on by

Continuing with the never ending series of malware email attachments  is an email with the subject of payment slip coming or pretending to come from random companies, names and email addresses with an ACE   attachment ( ACE files are a sort of zip file that normally needs special software to extract. Windows … Continue reading → Continue reading fake swift copy notification payment slip malspam with an ACE attachment delivers malware and a jrat Trojan→