Leo Fernandes

[Leo Fernandes @lovemalware]

@abuse_ch Awesome! I'll be happy to start sharing here too.

[Leo Fernandes @lovemalware]

7k Phishing Emails

Subject: CARGO ARRIVAL / Track Your Vessel (ETA

Attachment name: Shipping Documents.PDF.html

MD5: 2133f696d81418226c581cfb4e777066

C2: hxxps://tte-japan[.]com/wp-includes/pomo/view/ochiri/maersk/report-maerskline.php

[Leo Fernandes @lovemalware]

Phishing Campaign: Re: New Purchase Order (PO # 004)

Please find enclosed scanned copy of Purchase Order No.

Attachment name: pdf.html

C2: hxxp://josh-mckague[.]com/wp-includes/IXR/report-pdf.php

[Leo Fernandes @lovemalware]

@JayTHL Doc: 2d54840af552077dd03e10f27739f8bd
URL: hxxps://frenchbaroslo[.]com/phone.bin

[Leo Fernandes @lovemalware]

@JayTHL Found a few others from today:
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

[Leo Fernandes @lovemalware]

New MegaCortex sample: 5a507238e49e312672216581f023d562

Log file: C:\\mu0qnwctF5.log

Campaign: MEGA-F5=

Contact emails: [email protected] and
[email protected]

[abuse.ch @abuse_ch]

This chart shows the number of Emotet Vs. TrickBot malware samples since Jan 2019. You can clearly see the disappearance of Emotet 📉 malspam campaigns end of May and the rise of TrickBot 📈 in July that is nowadays used to deploy Ransomware 🔒💰on corporate networks 🏛️