Collaborate Disseminate
The latest in a long, long line of Dridex/Locky malware droppers spoofing random companies is an email with the subject of Re: pretending to come from random senders and email addresses with a zip attachment is another one which downloads Locky ransomware They use email addresses … Continue reading →
Continue reading Please find attached the file we spoke about yesterday leads to Locky
An email in Spanish language with the subject of NuevoDocumento 1 [ random numbered] pretending to come from random names at your own email domain with a malicious word doc attachment is another one from the current bot runs which downloads … Continue reading →
Continue reading NuevoDocumento 1 pretending to come from random names at your own email domain
An email with the subject of May Sale Invoices from xxxxxxxxxx pretending to come from random email addresses and names with a zip attachment containing a malicious word doc is another one from the current bot runs which try to download various … Continue reading →
Continue reading May Sale Invoices from random companies delivers unknown malware
Another email in the long line of nemucod JavaScript downloaders with the subject of Re: pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads Locky ransomware They use email addresses … Continue reading →
Continue reading I wanted to follow up with you about your refund leads to Locky
Another email pretending to come from your own email domain with the subject of Scanned image pretending to come from admin <southlandsxxxx@victimdomain.tld> with a zip (rar) attachment is another one from the current bot runs which downloads Locky Ransomware They use email … Continue reading →
Continue reading Scanned image pretending to come from your own email domain delivers Locky
An email with the subject of Scan #D34D94C50B_D8B8AAD5BA [ random characters ] pretending to come from HP Scanjet ( random email addresses starting with qwer at your own email domain ) with a zip attachment is another one from the current bot runs which downloads … Continue reading →
An email with the subject of You got a voice message! pretending to come from WhatsApp <Cleo477@gmx.de> with a zip attachment is another one from the current bot runs which downloads Locky Ransomware They use email addresses and subjects that will entice a … Continue reading →
Continue reading SPAM MALWARE: You got a voice message! WhatsApp delivers #Locky
An email with the subject of Thank you! pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads some unknown malware They use email addresses and subjects that will entice … Continue reading →
Continue reading SPAM MALWARE: Thank you! from random companies
An email with the subject of shipment address confirmation (re-send) pretending to come from info <info@dhl-services.com> with a zip attachment that extracts to a malicious word doc is another one from the current bot runs which try to download various Trojans and password stealers … Continue reading →
Continue reading SPAM MALWARE: shipment address confirmation (re-send)
An email with the subject of Invoice No. 424329473 from 18/05/2016 pretending to come from parcelforce.com <noreply@parcelforce.com> with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans … Continue reading →
Continue reading SPAM MALWARE: Invoice No. 424329473 from 18/05/2016