Threat insights 0x20: Infected
Sucurilabs Threat Insights is a summary of the past week's live phishing campaigns and email threats, delivered to you every Monday.
Fake shipping documents
- Rating: ★★★★☆
- Date: 2024-07-31
- Objective: Malware - Remcos RAT
- Analyst: José Morim
This email claims that the user has a couple due shipping documents to check. The goal is to get the recipient to open the malicious archive attached to the email and run a javascript file:
The malicious script runs a 2nd stage powershell script that drops the malware, infects and achieves persistance on the victim machine.
Account suspension update
- Rating: ★★☆☆☆
- Date: 2024-07-30
- Objective: Credential harvesting
- Analyst: José Morim
This email is claiming to be from the recipients email service provider. It falsely claims impending account suspension and urges the recipient to login to their email by clicking on the "Validate receipient@email.address Account" button:
By clicking the button the victim is lured into a malicious website impersonating a cPanel webmail service with the objective of stealing their credentials.
New payroll update
- Rating: ★★☆☆☆
- Date: 2024-07-30
- Objective: Credential harvesting
- Analyst: José Morim
This email impersonates the accounting department and claim to be a payroll update. The receipient is triggered to open a malicious link to check their new wage which should be payed by the end of august.
After they click the link, the user is served a generic credential harvesting page.
IOCs
| TYPE | IOC |
|---|---|
| FILE | 9d8821e8462c19565876d64aa8dfce3c7ab13138a4c949fad1adeb2837c6e7ad |
| FILE | e3bb14f9a0e4cde6b4df21b5a592b9974b1d8613f0ddf044f51b05c6368a3cd3 |
| URL | hxxps[://]pastecode[.]dev/raw/za6ml0dw/paste1[.]txt |
| URL | hxxps[://]ia601606[.]us[.]archive[.]org/10/items/deathnote_202407/deathnote[.]jpg |
| URL | hxxps[://]ipfs[.]io/ipfs/bafybeig2xqub5ymsaz7v2hxg4qyhk4njrki4zofy5qcm33nsmlk3o5x2hu |
| URL | hxxps[://]ipfs[.]io/ipfs/Qme6GwzDgftG6PoS19DCCKapAxZwJ4bjZQwgpuMZkC1sMC/webcube[.]html |
Keep up with threat insights
Threat insights is a weekly series were we present you with analysis from samples we collect. Follow us on social media for the latest feed and cybersecurity content. Stay informed and stay safe!
Get more insights like this
- Follow us on social media to get a weekly update of our latest content, and don't worry we won't spam your feed ;)
- Join our private beta and have a sneak peak of how your team will improve on their security posture.