2018-04-17 - QUICK POST: TRICKBOT MALSPAM AND TRAFFIC
Zip archives are password-protected with the standard password. If you don't know it, look at the "about" page of this website.
- 2018-04-17-Trickbot-malspam-3-email-examples.zip 73 kB (73,109 bytes)
- 2018-04-17-Trickbot-malspam-infection-traffic.pcap.zip 7.4 MB (7,437,710 bytes)
- 2018-04-17-Trickbot-infection-malware-and-artifacts.zip 218 kB (218,059 bytes)
NOTES:
- Following up on today's post by My Online Security about Fake HSBC emails distributing Trickbot via Microsoft Equation Editor exploit.
IMAGES
Shown above: Screenshot of the email.
Shown above: Opening the attached file on a vulnerable Windows host.
Shown above: Traffic from an infection filtered in Wireshark.
Shown above: Initial artifacts seen on the infected Windows host.
Shown above: Scheduled task to ensure persistence on the infected Windows host.
Shown above: Final artifacts seen on the infected Windows host (1 of 2).
Shown above: Final artifacts seen on the infected Windows host (2 of 2).
Click here to return to the main page.