2017-11-08 - HANCITOR MALSPAM - SUBJECT: RE: IPHONE X PRE-ORDER

ASSOCIATED FILES:

  • 2017-11-08-Hancitor-malspam-traffic.pcap   (1,024,590 bytes)
  • 2017-11-08-Hancitor-malspam-1648-UTC.eml   (1,190 bytes)
  • 2017-11-08-Hancitor-malspam-1708-UTC.eml   (1,163 bytes)
  • 2017-11-08-Hancitor-malspam-1735-UTC.eml   (1,153 bytes)
  • 2017-11-08-Hancitor-malspam-1835-UTC.eml   (1,147 bytes)
  • search.json.exe   (150,016 bytes)
  • tracking_info_760613.doc   (186,368 bytes)

 

NOTES:

 

EMAILS


Shown above:  Screenshot from one of the emails.

 

EMAIL HEADERS:

 


Shown above:  Clicking on a link from one of the emails.

 


Shown above:  Malicious Word document from link in the malspam.

 

TRAFFIC


Shown above:  Traffic from the infection filtered in Wireshark.

 

LINKS IN THE EMAILS TO THE WORD DOCUMENT:

NETOWRK TRAFFIC FROM MY INFECTED LAB HOST:

 

FILE HASHES

WORD DOCUMENT FROM LINK IN THE EMAIL:

MALWARE RETRIEVED FROM THE INFECTED HOST:

 

IMAGES


Shown above:  Zeus Panda Banker made persistent on the infected host.

 

FINAL NOTES

Once again, here are the associated files:

Zip archives are password-protected with the standard password.  If you don't know it, look at the "about" page of this website.

Click here to return to the main page.