Tag Archives: Trickbot

Trickbot banking Trojan delivered by spoofed HP_Printer at your own email address malspam

My Online Security Posted on by  

An email with the subject of Scanned Documents  pretending to come from HP Digital Device <HP_Printer@victim domain.tld>   with a malicious macro enabled  word doc  delivers Trickbot banking Trojan They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. You or your email provider or company have not been hacked or had their email or other servers compromised. They are not sending the emails to you. … Continue reading →

Trickbot banking Trojan delivered by spoofed sage outdated invoice

My Online Security Posted on by 1

An email with the subject of  pretending to come from  with a malicious word doc delivers Trickbot banking Trojan They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. The genuine Sage has not been hacked or had their email or other servers compromised. They are not sending the emails to you. They are just innocent victims in exactly the same way as every … Continue reading →

Please check the information malspam tries to deliver Trickbot banking trojan

My Online Security Posted on by  

The next in the never ending series of Malware downloaders is an email with the subject of  Please check the information-3878358  ( random numbers)  pretending to come from random names at your own email domain that tries to deliver Trickbot banking Trojan. The site they are using to download the malware appears to be down at time of posting. Please read this post about a concurrent malspam run delivering or trying to deliver Trickbot banking Trojan.  It looks like Trickbot are also changing their delivery method. Previously we have only seen macro enabled word docs as the delivery method. Today’s attempt at using … Continue reading →

Trickbot banking Trojan delivered via macro word docs spoofing Australian banks

My Online Security Posted on by  

The next in the never ending series of malware downloaders is an email with the subject of Payment has been made -3333 ( random numbers) pretending to come from various Australian banks with a macro enabled word doc that delivers Trickbot banking Trojan So far I have seen these banks spoofed in this malspam campaign spreading Trickbot banking Trojan Nab.com.au ANZ.com.au Westpac.com.au Suncorp.com.au Commbank.com.au anz.com Other subjects include: Confidential documents Check your Account Review Payment They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted … Continue reading →

Trickbot banking Trojan delivered by spoofed eFax malspam pretending to come from scanner @ your own email address

My Online Security Posted on by  

An email pretending to be an EFax delivery message with the subject of You have recevied a message  pretending to come from Fax Scanner  <scanner@victim domain.tld>  with a malicious word doc delivers  the latest Trickbot banking Trojan They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. 15 November  2016 : Message efax system-1332.doc        Current Virus total detections   Payload Security shows a download from ‘http://www.tessaban.com/admin/images/ldjslfjsnot.png’ which is … Continue reading →

Please check the information-1531221 : malspam delivers malware

My Online Security Posted on by  

An email with the subject of Please check the information-1531221 (random numbers ) pretending to come from random names at your own email domain  with a malicious word doc downloads what looks like Trickbot banking Trojan They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. You or your email server have not been hacked or had their email or other servers compromised. You /They are … Continue reading →

malspam email Companies House – new company complaint delivers Trickbot banking Trojan

My Online Security Posted on by  

An email with the subject of  Companies House – new company complaint pretending to come from Companies House <noreply@companieshouses.co.uk> with a malicious word doc with macros delivers Trickbot banking Trojan They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. Companies House has not been hacked or had their email or other servers compromised. They are not sending the emails to you. They are just … Continue reading →

malspam email GDS – New Fax Message delivers malware

My Online Security Posted on by  

An email with the subject of  GDS – New Fax Message pretending to come from GDS Fax <service@gov-fax.co.uk> with a malicious word doc containing macros which downloads what looks like Trickbot banking Trojan from the IP addresses it connects to, although VirusTotal are showing conflicting detections where a couple are detecting it as Cerber ransomware. I am not seeing the usual hundreds of connections that Cerber traditionally uses. They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium … Continue reading →

malspam email Payment has been made delivers Trickbot banking Trojan

My Online Security Posted on by  

An email with the subject of Payment has been made -9999 ( random number)  pretending to come from  random names @ random companies with a malicious word doc attachment delivers Trickbot banking Trojan. Trickbot is the successor to Dyre / Dyreza banking Trojan They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. A very high proportion are being targeted at small and medium size businesses, with the hope of getting a better response than they do from consumers. None of the companies alleged to be the senders or mentioned in the … Continue reading →

Important – New fax received malspam delivers Trickbot banking trojan

My Online Security Posted on by 2

A slightly unusual  email with the subject of  Important – New fax received pretending to come from Administrator <Administrator@internalfax.net> or  Administrator <Administrator@internalfax.com> with either a malicious word doc attachment  or a zip file containing a .js file which downloads Trickbot banking Trojan. It is very unusual to see the same banking Trojan, (although different versions )   being malspammed out concurrently, using the same email template but different file attachments and coming from 2 almost identical domains  a .net and a.com They are using email addresses and subjects that will scare or entice a user to read the email and open the attachment. … Continue reading →