2020-01-24 - ITALIAN MALSPAM PUSHES URSNIF

ASSOCIATED FILES:

  • 2020-01-24-Ursnif-IOCs.txt   (3,223 bytes)
  • 2020-01-24-Ursnif-malspam-example-1-of-4-0706-UTC.eml   (204,882 bytes)
  • 2020-01-24-Ursnif-malspam-example-2-of-4-0750-UTC.eml   (95,532 bytes)
  • 2020-01-24-Ursnif-malspam-example-3-of-4-0827-UTC.eml   (92,097 bytes)
  • 2020-01-24-Ursnif-malspam-example-4-of-4-0919-UTC.eml   (89,903 bytes)
  • 2020-01-24-Ursnif-infection-traffic.pcap   (958,317 bytes)
  • 2020-01-24-Ursnif-DLL-retrieved-using-XSL-file-example-4-of-4.bin   (279,552 bytes)
  • 2020-01-24-XSL-file-dropped-after-enabling-macros-on-Word-doc-example-4-of-4.txt   (3,740 bytes)
  • 2020-01-24-extracted-Word-doc-with-macro-for-Ursnif-example-1-of-4.doc   (67,329 bytes)
  • 2020-01-24-extracted-Word-doc-with-macro-for-Ursnif-example-2-of-4.doc   (67,240 bytes)
  • 2020-01-24-extracted-Word-doc-with-macro-for-Ursnif-example-3-of-4.doc   (67,331 bytes)
  • 2020-01-24-extracted-Word-doc-with-macro-for-Ursnif-example-4-of-4.doc   (67,331 bytes)
  • 2020-01-24-password-protected-zip-archive-with-Word-doc-for-Ursnif-example-1-of-4-password-111.zip   (60,667 bytes)
  • 2020-01-24-password-protected-zip-archive-with-Word-doc-for-Ursnif-example-2-of-4-password-222.zip   (60,573 bytes)
  • 2020-01-24-password-protected-zip-archive-with-Word-doc-for-Ursnif-example-3-of-4-password-111.zip   (60,668 bytes)
  • 2020-01-24-password-protected-zip-archive-with-Word-doc-for-Ursnif-example-4-of-4-password-111.zip   (60,668 bytes)

NOTES:

 

IMAGES


Shown above:  Traffic from an infection filtered in Wireshark.

 

Click here to return to the main page.