Dynamoo's Blog

  [For the February 2021 version of this list, click here ] When I was investigating IOCs for the recent outbreak of BadRabbit ransomware I...

A change to the usual Necurs rubbish, this fake order has a malformed .z archive file which contains a malicious executable with an icon t...

Checking these IOCs for this latest Flash 0-day came up with an interesting IP address of 89.45.67.107 which belongs to Fast Serv Inc ak...

This spam email is a scam: Subject :       Help Your Child To Be A Professional Footballer. From :       "FC Academy" [csa@sa...

This fake document scan delivers different malware depending on the victim's location: Subject :       Emailing: Scan0963 From :  ...

This spam has a .7z file leading to Locky ransomware. From :      "AutoPosted PI Notifier" [NoReplyMailbox@redacted.tld] Subj...

This fake Amazon spam comes with a malicious attachment: Subject :       Invoice RE-2017-09-21-00794 From :       "Amazon Marketp...

This spam leads to Locky ransomware: Subject :       Status of invoice From :       "Rosella Setter" ordering@[redacted] Da...

This spam email appears to be sent by the Necurs botnet, advertising a new Bitcoin-like cryptocurrency called QTUM. Necurs is often used t...

This spam email pretends to be from tayloredgroup.co.uk but it is just a simple forgery leading to Locky ransomware. There is both a mali...

The jumble of numbers in this spam is a bit confusing. Attached is a malicious RAR file that leads to Locky ransomware. Subject :      ...

This fake Sage invoice leads to Locky ransomware. Quite why Sage are picked on so much by the bad guys is a bit of a mystery. Subject ...

Two massive fake "Bill" spam runs seem to be under way, one claiming to be from BT and the other being more generic. Subject ...

This fairly generic spam leads to the Locky ransomware: Subject :       Copy of Invoice 3206 From :       "Customer Service" ...

This fake voice mail message leads to malware. It comes in two slightly different versions, one with a RAR file download and the other wit...

This fake voicemail leads to malware: Subject :       [PBX]: New message 46 in mailbox 461 from "460GOFEDEX" <8476446077...

I only have a couple of samples of this spam, but I suspect it comes in many different flavours.. Subject :       images From :       ...

Yesterday I saw a series spam emails from Necurs apparently attempting to collect replies to super.testtesttest2018@yahoo.com . Although t...

This email is sent from the Necurs botnet and appears to be collecting automatic replies, using a Reply-To email address of super.testtest...