2016-08-23 - BOLETO MALSPAM

ASSOCIATED FILES:

  • 2016-08-23-boleto-malspam-infection-traffic.pcap   (1,963,004 bytes)
  • 2016-08-23-boleto-malspam-artifacts-information.csv   (1,881 bytes)
  • 2016-08-23-boleto-malspam-emails.csv   (2,363 bytes)
  • 2016-08-23-0451-UTC-boleto-malspam.eml   (1,817 bytes)
  • 2016-08-23-0501-UTC-boleto-malspam.eml   (1,838 bytes)
  • 2016-08-23-0503-UTC-boleto-malspam.eml   (1,803 bytes)
  • 2016-08-23-0541-UTC-boleto-malspam.eml   (1,822 bytes)
  • 2016-08-23-0619-UTC-boleto-malspam.eml   (1,850 bytes)
  • 2016-08-23-0638-UTC-boleto-malspam.eml   (1,811 bytes)
  • 2016-08-23-0643-UTC-boleto-malspam.eml   (1,805 bytes)
  • 2016-08-23-0713-UTC-boleto-malspam.eml   (1,819 bytes)
  • 2016-08-23-0754-UTC-boleto-malspam.eml   (1,856 bytes)
  • 2016-08-23-0836-UTC-boleto-malspam.eml   (1,786 bytes)
  • 2016-08-23-0941-UTC-boleto-malspam.eml   (1,853 bytes)
  • 2016-08-23-1544-UTC-boleto-malspam.eml   (1,819 bytes)
  • Ionic.Zip.Reduced.dll   (253,440 bytes)
  • PSEXESVC.exe   (189,792 bytes)
  • SPRINGFIELD-PC.aes   (16 bytes)
  • SPRINGFIELD-PC.zip   (1,079,301 bytes)
  • VCTO23082016pozmo4ozQS0aWjcgqOpMjOyKwYU6sDvQ.vbs   (1,098 bytes)
  • aaaaaaaaaaaa.xml   (3,386 bytes)
  • dll.dll.exe   (396,480 bytes)
  • ij2yuclu.itw.vbs   (344 bytes)
  • tmp15F3.tmpps1   (3,463 bytes)
  • tmp2B35.tmp   (11,548 bytes)
  • tmp7003.tmp   (11,548 bytes)
  • wifopdhk.oja.vbs   (7,773 bytes)

 

MY PREVIOUS DOCUMENTATION ON THIS CAMPAIGN:

 

EMAILS


Shown above:  Data from the spreadsheet (1 of 2).

 


Shown above:  Data from the spreadsheet (2 of 2).

 


Shown above:  Example of the emails.

 

EMAIL DETAILS

EXAMPLES OF SENDING EMAIL ADDRESSES:

 

EXAMPLES OF SUBJECT LINES:

 

DOMAINS FROM LINKS IN THE EMAILS:

 

TRAFFIC


Shown above:  Traffic from the pcap filtered in Wireshark.

 

ASSOCIATED DOMAINS:

 

FINAL NOTES

Once again, here are the associated files:

ZIP files are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.