2020-01-23 - GERMAN MALSPAM PUSHES URSNIF

ASSOCIATED FILES:

  • 2020-01-23-Ursnif-IOCs.txt   (8,852 bytes)
  • 2020-01-23-Ursnif-malspam-example-1-of-4-0755-UTC.eml   (163,039 bytes)
  • 2020-01-23-Ursnif-malspam-example-2-of-4-0950-UTC.eml   (173,339 bytes)
  • 2020-01-23-Ursnif-malspam-example-3-of-4-0938-UTC.eml   (170,776 bytes)
  • 2020-01-23-Ursnif-malspam-example-4-of-4-1053-UTC.eml   (167,974 bytes)
  • 2020-01-23-Ursnif-infection-with-Ursnif-variant-as-follow-up-malware.pcap   (2,884,627 bytes)
  • 2020-01-23-Ursnif-DLL-retrieved-using-XSL-file-example-1-of-4.bin   (176,128 bytes)
  • 2020-01-23-Ursnif-DLL-retrieved-using-XSL-file-example-2-of-4.bin   (176,128 bytes)
  • 2020-01-23-Ursnif-DLL-retrieved-using-XSL-file-example-3-of-4.bin   (176,128 bytes)
  • 2020-01-23-Ursnif-DLL-retrieved-using-XSL-file-example-4-of-4.bin   (176,128 bytes)
  • 2020-01-23-XSL-file-dropped-after-enabling-macros-on-Word-doc-example-1-of-4.txt   (3,694 bytes)
  • 2020-01-23-XSL-file-dropped-after-enabling-macros-on-Word-doc-example-2-of-4.txt   (3,687 bytes)
  • 2020-01-23-XSL-file-dropped-after-enabling-macros-on-Word-doc-example-3-of-4.txt   (3,928 bytes)
  • 2020-01-23-XSL-file-dropped-after-enabling-macros-on-Word-doc-example-4-of-4.txt   (3,975 bytes)
  • 2020-01-23-another-Urnsif-variant-EXE-as-follow-up-malware-retrieved-by-Ursnif-infected-host.bin   (1,026,048 bytes)
  • 2020-01-23-example-of-registry-update-after-follow-up-Ursnif-variant-infection.txt   (11,508,802 bytes)
  • 2020-01-23-example-of-registry-update-caused-by-initial-Ursnif-infection.txt   (10,693,630 bytes)
  • 2020-01-23-extracted-Word-doc-with-macro-for-Ursnif-example-1-of-4.doc   (127,878 bytes)
  • 2020-01-23-extracted-Word-doc-with-macro-for-Ursnif-example-2-of-4.doc   (127,845 bytes)
  • 2020-01-23-extracted-Word-doc-with-macro-for-Ursnif-example-3-of-4.doc   (127,906 bytes)
  • 2020-01-23-extracted-Word-doc-with-macro-for-Ursnif-example-4-of-4.doc   (127,673 bytes)
  • 2020-01-23-password-protected-zip-archive-with-Word-doc-for-Ursnif-password-333-example-1-of-4.zip   (117,028 bytes)
  • 2020-01-23-password-protected-zip-archive-with-Word-doc-for-Ursnif-password-333-example-2-of-4.zip   (116,997 bytes)
  • 2020-01-23-password-protected-zip-archive-with-Word-doc-for-Ursnif-password-333-example-3-of-4.zip   (117,062 bytes)
  • 2020-01-23-password-protected-zip-archive-with-Word-doc-for-Ursnif-password-333-example-4-of-4.zip   (116,825 bytes)

NOTES:

 

IMAGES


Shown above:  Traffic from an infection filtered in Wireshark.

 

Click here to return to the main page.