Showing posts with label Ukraine. Show all posts
Showing posts with label Ukraine. Show all posts
Tuesday, 5 September 2017

Malware spam: "Scanning" pretending to be from tayloredgroup.co.uk

›
This spam email pretends to be from tayloredgroup.co.uk but it is just a simple forgery leading to Locky ransomware. There is both a mali...
Monday, 17 April 2017

Malware spam: "RE: RE: ftc refund" / secretary@ftccomplaintassistant.com

›
This fake FTC email leads to malware. Curiously, it was sent to a company that received a multimillion dollar FTC fine, but this is almost...
Thursday, 19 January 2017

Malware spam: "The Insolvency Service" / "Investigations Inquiry Notification" / chucktowncheckin.com / chapelnash.com

›
This malware spam in unusual in many respects. The payload may be some sort of ransomware [ UPDATE : this appears to be Cerber]. From :...
2 comments:
Monday, 19 December 2016

Malware spam: "Payslip for the month Dec 2016." leads to Locky

›
This fake financial spam leads to Locky ransomware: From :    PATRICA GROVES Date :    19 December 2016 at 10:12 Subject :    Payslip f...
Monday, 12 December 2016

Malware spam: "Invoice number: 947781" leads to Locky

›
This fake financial spam comes from multiple senders and leads to Locky ransomware: From :    AUTUMN RHINES Date :    12 December 201...
Friday, 9 December 2016

Malware spam: "Firewall Software" leads to Locky

›
This spam appears to come from multiple senders and leads to Locky ransomware: From :    Herman Middleton Date :    9 December 2016 at ...
Wednesday, 23 November 2016

Moar Locky: "Bill-12345" from victim's own domain

›
This spam has no body text and appears to come from within the sender's own domain. It leads to Locky ransomware. For example: From...
Tuesday, 22 November 2016

Malware spam: "Invoice 123456" from random sender in victim's own domain

›
This fake financial spam appears to come from a random sender in the victim's own domain, but this is just a simple forgery. The paylo...
1 comment:

Malware spam: "Delivery status" leads to Locky

›
This fake financial spam leads to Locky ransomware: Subject :     Delivery status From :     Gilbert Hancock Date :     Tuesday, 22 N...
Thursday, 17 November 2016

Malware spam: "Sage Invoice [service@sage-invoices.com]" / "Outdated Invoice" leads to Trickbot

›
This fake financial spam leads to the Trickbot banking trojan. From :    Sage Invoice [service@sage-invoices.com] Date :    17 November...
2 comments:
Tuesday, 8 November 2016

Malware spam: "Suspicious movements" leads to Locky

›
This fake financial spam leads to Locky ransomware: Subject :     Suspicious movements From :     Marlene Parrish Date :     Tuesday,...
Monday, 7 November 2016

Malware spam: "Financial documents" leads to Locky

›
The never-ending Locky ransomware onslaught continues. This fake financial spam has a malicious attachment: Subject :     Financial doc...
Thursday, 3 November 2016

Malware spam: "!!! Urgent payment request" from random senders leads to Locky

›
This spam comes from random senders, the name in the "From" field always matches the fake email signature. The number of exclama...

Moar Locky 2016-11-03

›
I haven't had much time to look at the Locky runs overnight, but here is a data dump of download locations and C2s (at the bottom) fro...
Wednesday, 2 November 2016

Malware spam: "Companies House - new company complaint" / noreply@companies-house.me.uk / noreply@companieshouses.co.uk leads to TrickBot

›
This fake Companies House spam leads to TrickBot malware : From :    Companies House [noreply@companieshouses.co.uk] Date :    2 Novemb...
Tuesday, 1 November 2016

Malware spam: "New Fax Message" / administrator@local-fax.com leads to TrickBot

›
This fake fax leads to TrickBot which appears to be similar to the Dyre banking trojan that we saw a lot of last year.. From :    Admi...
1 comment:

Malware spam: "This is to inform that the transaction you made yesterday is declined." leads to Locky

›
This fake financial spam leads to Locky ransomware: Subject :     Transaction declined From :     Chandra Frye Date :     Tuesday, 1 ...
Monday, 31 October 2016

Malware spam: "Wrong tracking number" leads to Locky

›
This spam email leads to Locky ransomware: From     "Samuel Rodgers" Date     Mon, 31 Oct 2016 15:21:22 +0530 Subject     W...
Friday, 28 October 2016

Malware spam: "Payment history" leads to Locky

›
Another morning, another spam run pushing Locky ransomware: Subject :     Payment history From :     Theodore Wilkins Date :     Frid...
Thursday, 27 October 2016

Malware spam: "E-TICKET 41648" leads to Locky

›
More Locky ransomware today.. From     "Matthew standaloft" Date     Thu, 27 Oct 2016 15:20:27 +0530 Subject     E-TICKET 416...