Malware-Traffic-Analysis.net - 2019-01-11 - Quick post: Wave of Trickbot malspam (gtag: sat32)

2019-01-11 - QUICK POST: WAVE OF TRICKBOT MALSPAM (GTAG: SAT32)

NOTICE:

The zip archives on this page have been updated, and they now use the new password scheme. For the new password, see the "about" page of this website.

ASSOCIATED FILES:

Zip archive of the infection traffic: 2019-01-11-Trickbot-infection-traffic.pcap.zip 12.6 MB (12,632,176 bytes)
Zip archive of the malware & artifacts: 2019-01-11-Trickbot-malware-and-artifacts.zip 5.7 MB (5,683,919 bytes)

NOTES:

Hadn't seen any malspam pushing Trickbot since the week before Christmas last year (somwtime before 2018-12-25).
This wave happened on Friday 2019-01-11, which is the first malspam I can confirm that was spreading Trickbot since then.
I don't have a copy of an email I could share, but I'm able to share some of the subject lines and attachment names.
I noticed several different file hashes for attached XLS spreadsheets from the malspam used to kick off the Trickbot infection chain, but the file size was consistent.
Each XLS attachment used to kick off a Trickbot infection was 94,720 bytes.

Shown above: Malspam and associated attachment.

Shown above: Infection traffic filtered in Wireshark.

EMAILS NOTED:

2019-01-11 15:44 UTC -- Attachment name: Transaction_Details_15545.xls -- Subject name: Order payment #oz820765 received
2019-01-11 15:45 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Order transaction #yv289681 accepted
2019-01-11 15:45 UTC -- Attachment name: Transaction_Details_15535.xls -- Subject name: Transaction for order #yw110230 approved
2019-01-11 15:46 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Order transaction #yv289681 accepted
2019-01-11 15:46 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Transaction for order #js798959 processed
2019-01-11 15:46 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Transaction for order #xh372265 approved
2019-01-11 15:47 UTC -- Attachment name: Transaction_Details_15503.xls -- Subject name: Payment for order #sk710642 processed
2019-01-11 15:47 UTC -- Attachment name: Transaction_Details_15503.xls -- Subject name: Transaction_for_order_#ie484477_processed
2019-01-11 15:47 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Order payment #zi144773 approved
2019-01-11 15:47 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Order transaction #xz800185 approved
2019-01-11 15:47 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Payment for order #lg466355 received
2019-01-11 15:47 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Payment for order #zu220896 processed
2019-01-11 15:47 UTC -- Attachment name: Transaction_Details_15527.xls -- Subject name: Your payment for order #qx127774 processed
2019-01-11 15:47 UTC -- Attachment name: Transaction_Details_15536.xls -- Subject name: Payment for order #rh225450 accepted
2019-01-11 15:47 UTC -- Attachment name: Transaction_Details_15536.xls -- Subject name: Your payment for order #ai501948 accepted
2019-01-11 15:47 UTC -- Attachment name: Transaction_Details_15552.xls -- Subject name: Your payment for order #yk996667 accepted
2019-01-11 15:47 UTC -- Attachment name: Transaction_Details_15575.xls -- Subject name: Payment_for_order_#im205580_approved
2019-01-11 15:47 UTC -- Attachment name: Transaction_Details_15587.xls -- Subject name: Transaction_for_order_#he685529_approved
2019-01-11 15:48 UTC -- Attachment name: Transaction_Details_15503.xls -- Subject name: Order transaction #iq454043 approved
2019-01-11 15:48 UTC -- Attachment name: Transaction_Details_15503.xls -- Subject name: Order_payment_#zu648813_approved
2019-01-11 15:48 UTC -- Attachment name: Transaction_Details_15503.xls -- Subject name: Transaction_for_order_#ql477308_received
2019-01-11 15:48 UTC -- Attachment name: Transaction_Details_15509.xls -- Subject name: Order transaction #tu963915 received
2019-01-11 15:48 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Order transaction #xz800185 approved
2019-01-11 15:48 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Transaction for order #ml817027 approved
2019-01-11 15:48 UTC -- Attachment name: Transaction_Details_15525.xls -- Subject name: Your_payment_for_order_#po269256_approved
2019-01-11 15:48 UTC -- Attachment name: Transaction_Details_15527.xls -- Subject name: Transaction for order #up650453 received
2019-01-11 15:48 UTC -- Attachment name: Transaction_Details_15536.xls -- Subject name: Your payment for order #ub737118 accepted
2019-01-11 15:48 UTC -- Attachment name: Transaction_Details_15545.xls -- Subject name: Order payment #xp694345 accepted
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Your payment for order #mu868455 processed
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15527.xls -- Subject name: Payment for order #kl295323 processed
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15527.xls -- Subject name: Payment for order #pw511228 accepted
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15527.xls -- Subject name: Transaction for order #yu732664 received
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15527.xls -- Subject name: Transaction for order #zv327576 processed
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15527.xls -- Subject name: Your payment for order #gh818010 processed
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Order payment #az140526 accepted
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Order payment #bd375170 approved
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Order payment #lt391268 approved
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Order transaction #pd636872 received
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Order transaction #vx861579 received
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Order transaction #wk891850 approved
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Payment for order #lw992677 accepted
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Payment for order #tk405347 approved
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Payment for order #ur413682 processed
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Payment for order #vw462069 received
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Transaction for order #em188494 approved
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Your payment for order #cr610431 accepted
2019-01-11 15:49 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Your payment for order #rg490424 processed
2019-01-11 15:50 UTC -- Attachment name: Transaction_Details_15536.xls -- Subject name: Your payment for order #cx947832 approved
2019-01-11 15:50 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Transaction for order #is556798 processed
2019-01-11 15:50 UTC -- Attachment name: Transaction_Details_15566.xls -- Subject name: Transaction for order #os849270 received
2019-01-11 15:50 UTC -- Attachment name: Transaction_Details_15583.xls -- Subject name: Transaction for order #of522549 received
2019-01-11 15:50 UTC -- Attachment name: Transaction_Details_15583.xls -- Subject name: Your payment for order #so283050 accepted
2019-01-11 15:51 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Order payment #zi144773 approved
2019-01-11 15:51 UTC -- Attachment name: Transaction_Details_15514.xls -- Subject name: Payment for order #lg466355 received
2019-01-11 15:51 UTC -- Attachment name: Transaction_Details_15571.xls -- Subject name: Order payment #bv278376 received
2019-01-11 15:51 UTC -- Attachment name: Transaction_Details_15583.xls -- Subject name: Order payment #qm281490 accepted
2019-01-11 15:51 UTC -- Attachment name: Transaction_Details_15583.xls -- Subject name: Transaction for order #dx945149 approved
2019-01-11 15:51 UTC -- Attachment name: Transaction_Details_15583.xls -- Subject name: Transaction for order #hh905359 received
2019-01-11 15:58 UTC -- Attachment name: Transaction_Details_15503.xls -- Subject name: Transaction_for_order_#we167895_accepted
2019-01-11 15:59 UTC -- Attachment name: Transaction_Details_15569.xls -- Subject name: Payment_for_order_#ha351170_received
2019-01-11 16:13 UTC -- Attachment name: Your_Order_Info_901009.xls -- Subject name: Order_transaction_#ib624740_accepted
2019-01-11 16:14 UTC -- Attachment name: Your_Order_Info_901026.xls -- Subject name: Transaction for order #bl721451 processed
2019-01-11 16:15 UTC -- Attachment name: Your_Order_Info_901067.xls -- Subject name: Order payment #bq950570 approved
2019-01-11 16:16 UTC -- Attachment name: Your_Order_Info_901035.xls -- Subject name: Transaction for order #eg257367 processed
2019-01-11 16:16 UTC -- Attachment name: Your_Order_Info_901088.xls -- Subject name: Transaction for order #ww690494 processed
2019-01-11 16:17 UTC -- Attachment name: Your_Order_Info_901006.xls -- Subject name: Transaction for order #vs572775 received
2019-01-11 16:17 UTC -- Attachment name: Your_Order_Info_901009.xls -- Subject name: Order transaction #bo665277 received
2019-01-11 16:17 UTC -- Attachment name: Your_Order_Info_901037.xls -- Subject name: Order payment #oi232764 processed
2019-01-11 16:18 UTC -- Attachment name: Your_Order_Info_901006.xls -- Subject name: Your payment for order #am514716 processed
2019-01-11 16:18 UTC -- Attachment name: Your_Order_Info_901035.xls -- Subject name: Payment_for_order_#wd416643_processed
2019-01-11 16:18 UTC -- Attachment name: Your_Order_Info_901050.xls -- Subject name: Transaction for order #dx737262 processed
2019-01-11 16:21 UTC -- Attachment name: Your_Order_Info_901034.xls -- Subject name: Order transaction #va285193 received
2019-01-11 16:21 UTC -- Attachment name: Your_Order_Info_901034.xls -- Subject name: Payment_for_order_#gu981768_accepted
2019-01-11 16:21 UTC -- Attachment name: Your_Order_Info_901097.xls -- Subject name: Order payment #iq741592 accepted
2019-01-11 16:22 UTC -- Attachment name: Your_Order_Info_901034.xls -- Subject name: Order_payment_#px953748_received
2019-01-11 16:22 UTC -- Attachment name: Your_Order_Info_901034.xls -- Subject name: Order_payment_#se996907_received
2019-01-11 16:22 UTC -- Attachment name: Your_Order_Info_901034.xls -- Subject name: Order_transaction_#rg658879_received
2019-01-11 16:22 UTC -- Attachment name: Your_Order_Info_901034.xls -- Subject name: Order_transaction_#um829643_processed
2019-01-11 16:22 UTC -- Attachment name: Your_Order_Info_901034.xls -- Subject name: Payment for order #sd241684 approved
2019-01-11 16:22 UTC -- Attachment name: Your_Order_Info_901034.xls -- Subject name: Payment_for_order_#xy326442_processed
2019-01-11 16:27 UTC -- Attachment name: Your_Order_Info_901006.xls -- Subject name: Your payment for order #gc974316 received
2019-01-11 16:36 UTC -- Attachment name: Your_Order_Info_901002.xls -- Subject name: Payment for order #yf832736 approved
2019-01-11 16:38 UTC -- Attachment name: Your_Order_Info_901097.xls -- Subject name: Order payment #iq741592 accepted
2019-01-11 16:41 UTC -- Attachment name: Your_Order_Info_901097.xls -- Subject name: Your payment for order #za786156 accepted
2019-01-11 16:42 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Payment for order #wy797471 processed
2019-01-11 16:43 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Order payment #ai536321 received
2019-01-11 16:43 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Order payment #ne926065 processed
2019-01-11 16:43 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Order transaction #ta151222 received
2019-01-11 16:43 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Payment for order #ma748020 processed
2019-01-11 16:43 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Payment for order #te559089 approved
2019-01-11 16:44 UTC -- Attachment name: Your_Order_Info_901002.xls -- Subject name: Transaction for order #ds771177 processed
2019-01-11 16:44 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Order transaction #jl931454 approved
2019-01-11 16:44 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Transaction for order #nq171221 processed
2019-01-11 16:44 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Your payment for order #ch478350 accepted
2019-01-11 16:45 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Order payment #td632920 processed
2019-01-11 16:45 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Your payment for order #rg340087 accepted
2019-01-11 16:47 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Order payment #fk530267 accepted
2019-01-11 16:49 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Transaction for order #bk839741 received
2019-01-11 16:50 UTC -- Attachment name: Your_Order_Info_901065.xls -- Subject name: Transaction for order #am180213 received
2019-01-11 16:57 UTC -- Attachment name: Your_Order_Info_901097.xls -- Subject name: Your payment for order #za786156 accepted
2019-01-11 17:02 UTC -- Attachment name: Your_Order_Info_901097.xls -- Subject name: Order payment #iq741592 accepted
2019-01-11 17:15 UTC -- Attachment name: Your_Order_Info_901002.xls -- Subject name: Your payment for order #om124229 approved
2019-01-11 17:21 UTC -- Attachment name: Your_Order_Info_901097.xls -- Subject name: Your payment for order #za786156 accepted
2019-01-11 17:24 UTC -- Attachment name: Your_Order_548252.xls -- Subject name: Order payment #co312056 accepted
2019-01-11 17:24 UTC -- Attachment name: Your_Order_548252.xls -- Subject name: Your payment for order #bs757327 accepted
2019-01-11 17:24 UTC -- Attachment name: Your_Order_548252.xls -- Subject name: Your payment for order #zl774678 received
2019-01-11 17:24 UTC -- Attachment name: Your_Order_548258.xls -- Subject name: Order payment #fw894773 approved
2019-01-11 17:24 UTC -- Attachment name: Your_Order_548270.xls -- Subject name: Transaction for order #xi620646 received
2019-01-11 17:26 UTC -- Attachment name: Your_Order_548252.xls -- Subject name: Order payment #ok992581 approved
2019-01-11 17:26 UTC -- Attachment name: Your_Order_548252.xls -- Subject name: Order payment #uu602802 approved
2019-01-11 17:26 UTC -- Attachment name: Your_Order_548252.xls -- Subject name: Payment for order #ah953961 approved
2019-01-11 17:26 UTC -- Attachment name: Your_Order_548281.xls -- Subject name: Payment for order #ex199333 accepted
2019-01-11 17:27 UTC -- Attachment name: Your_Order_548281.xls -- Subject name: Payment for order #hy611424 approved
2019-01-11 17:38 UTC -- Attachment name: Your_Order_Info_901097.xls -- Subject name: Order payment #iq741592 accepted
2019-01-11 17:44 UTC -- Attachment name: Your_Order_Info_901002.xls -- Subject name: Order payment #lo491481 accepted
2019-01-11 17:45 UTC -- Attachment name: Your_Order_548288.xls -- Subject name: Order transaction #ap661103 approved
2019-01-11 17:48 UTC -- Attachment name: Your_Order_548288.xls -- Subject name: Transaction for order #yo773720 received
2019-01-11 17:57 UTC -- Attachment name: Your_Order_Info_901097.xls -- Subject name: Your payment for order #za786156 accepted
2019-01-11 18:09 UTC -- Attachment name: About_Order_#5037247.xls -- Subject name: Your payment for order #dm826310 processed
2019-01-11 18:10 UTC -- Attachment name: About_Order_#5037247.xls -- Subject name: Order transaction #uz967538 received
2019-01-11 18:11 UTC -- Attachment name: About_Order_#5037230.xls -- Subject name: Transaction_for_order_#rr280754_approved
2019-01-11 18:11 UTC -- Attachment name: About_Order_#5037246.xls -- Subject name: Transaction for order #xk389443 approved
2019-01-11 18:12 UTC -- Attachment name: About_Order_#5037292.xls -- Subject name: Order payment #yw318025 processed
2019-01-11 18:12 UTC -- Attachment name: About_Order_#5037292.xls -- Subject name: Payment for order #jy531729 accepted
2019-01-11 18:13 UTC -- Attachment name: About_Order_#5037236.xls -- Subject name: Transaction for order #iq995288 received
2019-01-11 18:13 UTC -- Attachment name: About_Order_#5037236.xls -- Subject name: Your payment for order #mv768512 received
2019-01-11 18:13 UTC -- Attachment name: About_Order_#5037245.xls -- Subject name: Order payment #cm726981 approved
2019-01-11 18:13 UTC -- Attachment name: About_Order_#5037245.xls -- Subject name: Transaction for order #ew320867 accepted
2019-01-11 18:13 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Payment for order #jr276700 received
2019-01-11 18:13 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Your payment for order #ao963651 received
2019-01-11 18:14 UTC -- Attachment name: About_Order_#5037201.xls -- Subject name: Your payment for order #bt306365 approved
2019-01-11 18:15 UTC -- Attachment name: About_Order_#5037201.xls -- Subject name: Transaction for order #ow882860 received
2019-01-11 18:15 UTC -- Attachment name: About_Order_#5037201.xls -- Subject name: Your payment for order #bf329345 received
2019-01-11 18:26 UTC -- Attachment name: About_Order_#5037275.xls -- Subject name: Your payment for order #xq804567 accepted
2019-01-11 18:36 UTC -- Attachment name: About_Order_#5037275.xls -- Subject name: Your payment for order #xq804567 accepted
2019-01-11 18:44 UTC -- Attachment name: Your_Order_Info_901097.xls -- Subject name: Order payment #iq741592 accepted
2019-01-11 18:47 UTC -- Attachment name: Your_Order_Info_901002.xls -- Subject name: Order transaction #py870562 processed
2019-01-11 18:52 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Order payment #rs555920 received
2019-01-11 18:52 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Payment for order #jr276700 received
2019-01-11 18:52 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Your payment for order #ao963651 received
2019-01-11 18:56 UTC -- Attachment name: Your_Order_Info_901002.xls -- Subject name: Order transaction #py870562 processed
2019-01-11 19:00 UTC -- Attachment name: Your_Order_Info_901097.xls -- Subject name: Your payment for order #za786156 accepted
2019-01-11 19:03 UTC -- Attachment name: Transaction_Details_15561.xls -- Subject name: Order transaction #lu684475 processed
2019-01-11 19:22 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Order payment #rs555920 received
2019-01-11 19:23 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Your payment for order #ao963651 received
2019-01-11 19:37 UTC -- Attachment name: About_Order_#5037275.xls -- Subject name: Your_payment_for_order_#qc619817_approved
2019-01-11 19:47 UTC -- Attachment name: About_Order_#5037275.xls -- Subject name: Your_payment_for_order_#qc619817_approved
2019-01-11 19:50 UTC -- Attachment name: Transaction_Details_15545.xls -- Subject name: Transaction for order #jh898698 accepted
2019-01-11 19:52 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Order payment #rs555920 received
2019-01-11 19:52 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Your payment for order #ao963651 received
2019-01-11 20:22 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Order payment #rs555920 received
2019-01-11 20:22 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Your payment for order #ao963651 received
2019-01-11 20:36 UTC -- Attachment name: Your_Order_Info_901097.xls -- Subject name: Order payment #iq741592 accepted
2019-01-11 20:51 UTC -- Attachment name: Your_Order_Info_901097.xls -- Subject name: Your payment for order #za786156 accepted
2019-01-11 20:52 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Order payment #rs555920 received
2019-01-11 20:52 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Your payment for order #ao963651 received
2019-01-11 21:19 UTC -- Attachment name: Transaction_Details_15506.xls -- Subject name: Order transaction #zo458522 approved
2019-01-11 21:22 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Order payment #rs555920 received
2019-01-11 21:22 UTC -- Attachment name: About_Order_#5037259.xls -- Subject name: Your payment for order #ao963651 received
2019-01-11 21:41 UTC -- Attachment name: Your_Order_548211.xls -- Subject name: Payment for order #yh592212 accepted

Click here to return to the main page.