From: admin [admin@victimdomain.tld]Attached is a file DOC201114-201114-001.js which comes in a variety of different variants. The payload appears to be the Dridex banking trojan, as seen in this earlier spam run.
Date: 4 February 2016 at 08:17
Subject: More scans
3 comments:
I've had the same email myself. I was wondering whether I should contact my hosting company about it?
These guys got me :( How do I get rid of this ?
Got it yesterday and was concerned for my site (assumed origination) but found no evidence of hacking. Then found this page. Never downloaded or opened the file on my system. It looked like a javascript file. I did open that in another browser window. But I think I was on the Linux side of my system at that time. Searched both sides of system with no results. I guess I am safe.
Post a Comment