2019-09-30 - DATA DUMP: HANCITOR-STYLE AMADEY

ASSOCIATED FILES:

• 2019-09-30-Hancitor-style-Amadey-IOCs.txt.zip   1.7 kB (1,748 bytes)
• 2019-09-30-Hancitor-style-Amadey-malspam-3-examples.zip   4.5 kB (4,475 bytes)
• 2019-09-30-Hancitor-style-Amadey-infection-traffic.pcap.zip   610 kB (610,380 bytes)
• 2019-09-30-Hancitor-style-Amadey-malware-and-artifacts.zip   277 kB (276,510 bytes)

NOTES:

• On Monday 2019-09-30, malspam pushing Amadey used links to fake IRS pages.
• This is an evolution of the long-running Hancitor malspam campaign.
• Since July 2019 this campaign switched from Hancitor to Amadey (link)
• Therefore, I've been calling this Hancitor-style Amadey.

• Zip archives are password-protected with the standard password.  If you don't know it, see the "about" page of this website.

 

Click here to return to the main page.