Collaborate Disseminate
An email with the subject of Upcoming Payment – 1 Month Notice pretending to come from random senders and email addresses with a zip attachment is another one from the current bot runs which downloads Dridex. In exactly the same way … Continue reading → Continue reading Upcoming Payment – 1 Month Notice – JS malware delivers #Dridex
An email with the subject of Someone Might Be Using Your Account 022FCF [random characters] pretending to come from random names and email addresses with a malicious word doc rtf or a zip file attachment is another one from the current bot … Continue reading → Continue reading Someone Might Be Using Your Account – word doc macro malware leads to #Dridex
An email with the subject of pretending to come from random email addresses with a malicious word doc RTF attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex … Continue reading → Continue reading Your ID card has been found – word doc macro malware
After this failed attempt, the Dridex / Locky gang have done a quick turnaround and reissued the malware repackaged in a working zip. This one is a blank email with the subject of Ticket pretending to come from random names @ … Continue reading → Continue reading blank email saying Ticket – JS malware delivers #Locky
An email with the subject of Bill Copy pretending to come from Jaypee <jaypeehp@gmail.com> with a zip attachment is another one from the current bot runs which is supposed to contain malware. All copies that I have received have had a … Continue reading → Continue reading Jaypee jaypeehp@gmail.com Bill Copy – corrupt attachment
An email with the subject of Refund Unsuccessful C1CE [ random characters] pretending to come from random senders with a zip attachment is another one from the current bot runs which downloads some malware, possibly Dridex banking Trojan, but might … Continue reading → Continue reading Refund Unsuccessful Your order has been cancelled however we are not able to proceed with the refund – JS malware
An email pretending to be a notification that you need to update your webmail certificate with the subject of Certificate UPDATE pretending to come from Incoming Fax <Incoming.Fax@your own email domain > with a zip attachment is another one from the current … Continue reading → Continue reading Certificate UPDATE pretending to come from Incoming Fax at your own email address – JS malware
An email with the subject of Scan Data pretending to come from DocuCentre-IV <DocuCentre071@your email address > with a malicious word doc attachment is another one from the current bot runs which try to download various Trojans and password stealers especially banking Trojans like Dridex … Continue reading → Continue reading Scan Data DocuCentrexxx@your email address – word doc macro malware
An email with the subject of Thank you! Your online order was placed successfully pretending to come from random names and email addresses with a malicious word RTF doc attachment is another one from the current bot runs which try to download various … Continue reading → Continue reading Thank you! Your online order was placed successfully – word doc rtf macro malware
An email with the subject of RE: pretending to come from random names & email addresses with a zip attachment is another one from the current bot runs which downloads Locky ransomware. This is another one that has a massive 525kb js file … Continue reading → Continue reading Your balance and recent transaction history is attached to this mail. Please verify it – JS malware leads to Locky