August 2, 2024
This email claims that the user has a couple due shipping documents to check. The goal is to get the recipient to open the malicious archive attached to the email and run a javascript file:
The malicious script runs a 2nd stage powershell script that drops the malware, infects and achieves persistance on the victim machine.
This email is claiming to be from the recipients email service provider. It falsely claims impending account suspension and urges the recipient to login to their email by clicking on the "Validate receipient@email.address Account" button:
By clicking the button the victim is lured into a malicious website impersonating a cPanel webmail service with the objective of stealing their credentials.
This email impersonates the accounting department and claim to be a payroll update. The receipient is triggered to open a malicious link to check their new wage which should be payed by the end of august.
After they click the link, the user is served a generic credential harvesting page.
| TYPE | IOC |
|---|---|
| FILE | 9d8821e8462c19565876d64aa8dfce3c7ab13138a4c949fad1adeb2837c6e7ad |
| FILE | e3bb14f9a0e4cde6b4df21b5a592b9974b1d8613f0ddf044f51b05c6368a3cd3 |
| URL | hxxps[://]pastecode[.]dev/raw/za6ml0dw/paste1[.]txt |
| URL | hxxps[://]ia601606[.]us[.]archive[.]org/10/items/deathnote_202407/deathnote[.]jpg |
| URL | hxxps[://]ipfs[.]io/ipfs/bafybeig2xqub5ymsaz7v2hxg4qyhk4njrki4zofy5qcm33nsmlk3o5x2hu |
| URL | hxxps[://]ipfs[.]io/ipfs/Qme6GwzDgftG6PoS19DCCKapAxZwJ4bjZQwgpuMZkC1sMC/webcube[.]html |
Threat insights is a weekly series were we present you with analysis from samples we collect. Follow us on social media for the latest feed and cybersecurity content. Stay informed and stay safe!
