Collaborate Disseminate
A Portuguese / Brazilian language email with the subject of Nota Fiscal Eletronica 09/05/2016 91616 pretending to come from OESA COMERCIO E REPRESENTACOES LTDA <naoresponder@oesa.com.br> with a zip attachment is another one from the current bot runs which downloads Locky ransomware They use email … Continue reading → Continue reading MALWARE: “Nota Fiscal Eletronica 09/05/2016 91616” delivers #Locky
An email with the subject of FW: pretending to come from random senders with a zip attachment is another one from the current bot runs which downloads what looks like Dridex banking Trojan. We had suspicions at the end of last week … Continue reading → Continue reading Malware: “Please find your monthly credit card statement attached to this e-mail”
An email with the subject of RE: pretending to come from random senders with a zip attachment is another one from the current bot runs which downloads They use email addresses and subjects that will entice a user to read the email … Continue reading → Continue reading Malware: “As I promised the information you requested is attached” leads to Locky
An email pretending to be a receipt containing terrible spelling or typing mistakes with the subject of Re:Draft Receipt pretending to come from Awad S.Yafie <yinengchem@yeah.net> with a malicious word doc attachment is another one from the current bot runs which try … Continue reading → Continue reading Malware: Yafie Group “Re:Draft Receipt”
An email that appears to come from Western Union with the subject of FWD:IMPORTANT TRANSACTION SENDOUT REVIEW pretending to come from InternationalOperations@ababank.com <spil@tim.spil.co.id> with a zip attachment is another one from the current bot runs which delivers malware. This appears to … Continue reading → Continue reading MALWARE: “FWD:IMPORTANT TRANSACTION SENDOUT REVIEW”
An email with the subject of Unity Link New Server Update pretending to come from info@unitylink.com with a zip attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking credential stealers, which may … Continue reading → Continue reading Unity Link New Server Update
An email saying Sent from my Samsung device with the subject of scan pretending to come from random names at Gmail.com with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans … Continue reading → Continue reading Sent from my Samsung device Scan – word doc macro malware delivering #Locky
An email with the subject of Verify Reciver Details and Advice For Payout pretending to come from amirmuhammed@almuzaniexchange.ae <abimks@buanaindependent.co.id> with a rar attachment which contains a java file and the jpg image which is shown in the email screenshot is another one from … Continue reading → Continue reading Verify Reciver Details and Advice For Payout – malware
An email with the subject of Re: pretending to come from random senders with a zip attachment is another one from the current bot runs which downloads Locky ransomware. Once again the zip contains 3 identical copies of the JavaScript downloaders which … Continue reading → Continue reading I have attached the spreadsheet contains last 50 transaction and your account actual balance – JS malware delivers Locky
Continuing with the overnight Malspam runs is yet another Dridex dropper with a long list of sites embedded inside the encrypted JavaScript file. This is an email with the subject of New Payment Received pretending to come from random senders and … Continue reading → Continue reading New Payment Received – JS malware delivers #Dridex