Collaborate Disseminate
A slightly later start than usual with the Locky / Dridex gang spambots sending out malware laden emails. We start today with an email with the subject of The invoices from CAMBIUM GLOBAL TIMBERLAND LTD [ random company names ] … Continue reading →
Continue reading The invoices from random companies delivering Dridex /Locky via Microsoft certutil
An email with the subject of We Have Received Your Payment – Thank You (#49407B2) [ random numbered] pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads Locky … Continue reading →
Continue reading We Have Received Your Payment – Thank You (#49407B2) delivers Locky
Another email From the Dridex /Locky gang with the subject of Re: pretending to come from random senders, companies and email addresses with a zip attachment is another one from the current bot runs which downloads what is almost guaranteed to be … Continue reading →
Continue reading Please find attached the statement that matches back to your invoices
An email with the subject of SAFARI LPO [MAL] 337659 [ random numbered] pretending to come from purchase@safarigroup.net with a zip attachment is another one from the current bot runs which downloads Locky ransomware They use email addresses and subjects that will entice … Continue reading →
An email with the subject of Suspicious logon attempt pretending to come from random senders, companies and email addresses with a malicious word doc inside a zip attachment is another one from the current bot runs which try to download various Trojans … Continue reading →
Continue reading Suspicious logon attempt or Account Compromised leads to Dridex
An email with the subject of New Message from Administrator pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads some malware probably Locky ransomware with anti-debugging, anti-analysis protection. They use … Continue reading →
An email with the subject of Updated Exchange Rates For All Agents pretending to come from Western Union Business Solution. <Gerard.Evans@westernunion.com> with a zip attachment is another one from the current bot runs which delivers a java jacksbot. If you do … Continue reading →
Continue reading Updated Exchange Rates For All Agents – Java malware
An email with the subject of Advertising Fee (910956) [ random numbered] pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads Locky ransomware They use email addresses and … Continue reading →
Following on from THIS post about malspam where no payload was found is an email with the subject of Last WARNING (REF1AC6) [ random numbered] pretending to come from random senders and email addresses with a zip attachment which does … Continue reading →
An email with the subject of Account Deleted pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which are supposed to download either Locky or Dridex by the look … Continue reading →