2014-09-09 - ASPROX BOTNET PHISHING EMAILS - DELTA AIRLINES

ASSOCIATED FILES:

 

NOTES:

 

EXAMPLES OF THE PHISHING EMAILS

SCREENSHOT - EXAMPLE 1:

 

SCREENSHOT - EXAMPLE 2:

 

SCREENSHOT - EXAMPLE 3:

 

MESSAGE TEXT - EXAMPLE 1:

From: Delta Air <help@startcomputerrepair.com>
Sent: Monday, September 08, 2014 15:59 UTC
To:
Subject: The order #00354911 is ready

Dear Customer,

ELECTRONIC TICKET NUMBER / ET-02442799
SEAT / 72F/ZONE 3
DATE / TIME 7 OCTOBER, 2014, 12:15 PM
ARRIVING / Stockton
FORM OF PAYMENT / XXXXXX
TOTAL PRICE / 272.19 USD
REF / EK.0183 ST / OK
BAG / 7PC

Please find your ticket attached.
You can print your ticket.

Thank you for your attention.
Delta Air Lines.

Attachment: ET-68435506.zip (108.6 KB)

 

MESSAGE TEXT - EXAMPLE 2:

From: Delta Air Lines <support@cavestclair.com>
Date: Tuesday, September 9, 2014 at 18:26 UTC
To:
Subject: Your order # ID16-00637196 has been completed

Dear Client,

TICKET / ET-10864422
SEAT / 63F/ZONE 1
DATE / TIME 7 OCTOBER, 2014, 12:25 AM
ARRIVING / Philadelphia
FORM OF PAYMENT / XXXXXX
TOTAL PRICE / 281.38 USD
REF / EK.0807 ST / OK
BAG / 2PC
Your ticket is attached.
To use your ticket you should print it.

Thank you for your attention.
Delta Air Lines.

Attachment: ET-11336156.zip (101.5 KB)

 

MESSAGE TEXT - EXAMPLE 3:

From: Delta Air Lines <custservice@sydneystair.com>
Date: Tuesday, September 9, 2014 at 19:57 UTC
To:
Subject: Your order # NR17-00043949 has been completed

Dear Customer,

ELECTRONIC TICKET / ET-22307486
SEAT / 64A/ZONE 1
DATE / TIME 1 OCTOBER, 2014, 12:55 AM
ARRIVING / Newport News
FORM OF PAYMENT / XXXXXX
TOTAL PRICE / 278.39 USD
REF / LE.9116 ST / OK
BAG / 1PC

Your electronic ticket is attached to the letter as a scan document.
You can print your ticket.

Thank you for your attention.
Delta Air Lines.

Attachment: ET-81809167.zip (111.8 KB)

 

MALWARE EXAMPLES

 

TRAFFIC AND SNORT EVENTS

LIVE TRAFFIC - 4845A080EAE462CCB2F3A3EB014D073F:

SNORT EVENTS:

 

LIVE TRAFFIC - 6B20036E7B3AE7A24231FF351A9251E1:

SNORT EVENTS:

 

SANDBOX TRAFFIC - DAFEE9AA102B64A21C15AF6208537DC0:

SNORT EVENTS:

 

LIVE TRAFFIC - F8825C98266E7549515F7479ACC4CB04:

SNORT EVENTS:

 

FINAL NOTES

Once again, here are the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.