silence-is-best

Date,Summary ,Details,Category,Sub Category,Email Payload Type,Users Targeted
7/1/2024,Malicious email campaign; morning,Top Urgent Order; 7z -> vbs -> guloader,Email,Malware,Attachment,4
7/1/2024,Malicious email campaign; morning,Re: Solicita��o de Pagamento - Fatura Proforma 924318184; 7z -> formbook,Email,Malware,Attachment,2
7/1/2024,Malicious email campaign; evening,Urgent files; 7z -> vbs -> guloader continued to 7/2,Email,Malware,Attachment,3
7/2/2024,Malicious email campaign; morning,INQUIRY 2024-SP0006-B(01) INQ24-012207; rar -> xloader continued to 7/8,Email,Malware,Attachment,16
7/2/2024,Malicious email campaign; morning,Re: Revised Proforma; tar -> vbs -> guloader,Email,Malware,Attachment,3
7/4/2024,Malicious email campaign; morning,Attachment name is revised pi_2024.lzh; lzh -> originlogger continued to 7/12,Email,Malware,Attachment,8
7/8/2024,Malicious email campaign; evening,Re: Your Proforma Pending Payments; 7z -> vbs -> guloader,Email,Malware,Attachment,2
7/9/2024,Malicious email campaign; m

silence-is-best

// Get ConfigStateUpdate and SensorHeartbeat events
#event_simpleName=/^(ConfigStateUpdate|SensorHeartbeat)$/ event_platform=Win 
// Narrow search to Channel File 291 and extract version number; accept all SensorHeartbeat events within impact window
| case{
    #event_simpleName=ConfigStateUpdate | regex("\|1,123,(?<CFVersion>.*?)\|", field=ConfigStateData, strict=false) | parseInt(CFVersion, radix=16);
    #event_simpleName=SensorHeartbeat | rename([[@timestamp, LastSeen]]);
}


| case{

silence-is-best

Date,Summary ,Details,Email Payload Type,Users Targeted
6/2/2024,Malicious email campaign; morning,AW: RE: Payment; ace -> originlogger,Attachment,6
6/3/2024,Malicious email campaign; morning,Aw:Aw: Aw:New order - Revised Invoice/Advanced payment; doc -> remcos,Attachment,7
6/3/2024,Malicious email campaign; evening,Quotation Request - RFQ018232901983234; zip -> vbs -> formbook,Attachment,8
6/4/2024,Malicious email campaign; morning,"New PO for Project - 00775, 00875 & 02195; zip -> remcos",Attachment,7
6/4/2024,Malicious email campaign; evening,New order PO00211 - Delivery next month; xlam -> originlogger,Attachment,3
6/5/2024,Malicious email campaign; morning,RE: Request For Quote; z -> originlogger,Attachment,4
6/5/2024,Malicious email campaign; evening,Your Shipment Just Arrived -SGS; xlam:rar -> originlogger continued to 6/10,Attachment,4
6/6/2024,Malicious email campaign; evening,Advice from Standard Chartered Bank; xz -> originlogger,Attachment,2
6/7/2024,Malicious email campaign; evening,ROQ // NYMPH 

silence-is-best

Date,Summary ,Details,Email Payload Type,Users Targeted
5/2/2024,Malicious email campaign; morning,RE:AW:AW:AW SHIPMENT ARRIVAL NOTICE AWB5889829680; zip -> formbook,Attachment,6
5/2/2024,Malicious email campaign; morning,Fw: MT103 Failed /Returned; zip -> formbook,Attachment,6
5/2/2024,Malicious email campaign; morning,Re: Telecon follow up / Purchase order; zip -> formbook,Attachment,6
5/2/2024,Malicious email campaign; afternoon,Aw: Proforma Invoice; rar -> originlogger,Attachment,4
5/3/2024,Malicious email campaign; morning,Request For Quotation; lzh -> vbs -> originlogger,Attachment,3
5/6/2024,Malicious email campaign; morning,PO 211436; zip -> originlogger,Attachment,4
5/8/2024,Malicious email campaign; morning,"Eurofins Tsing Hua Environment Testing Co., Ltd Purchase Order; lzh ->",Attachment,20
5/12/2024,Malicious email campaign; afternoon,Pre-production Samples; img -> originlogger,Attachment,5
5/12/2024,Malicious email campaign; afternoon,NEW PO DTL20-041 FOB Quote Best Prices; doc -> lokibot,Attach

silence-is-best

Date,Details,Email Payload Type,Users Targeted
4/2/2024,Booking.com invoice 1467466252; pdf -> js -> originlogger,Attachment,3
4/2/2024,RE: New Urgent Order; zip -> originlogger,Attachment,3
4/4/2024,RES: RES : Request For Quotation; gz -> remcos,Attachment,4
4/7/2024,Quotation request _?FL202306200039?; z -> originlogger,Attachment,4
4/8/2024,Request for Quotation; xls -> remcos,Attachment,4
4/8/2024,Payment Advice - Advice Ref:[A22D4YdWsbE4] / Priority payment / Customer Ref; z -> originlogger,Attachment,4
4/8/2024,Attachment name is document.r15; -> originlogger,Attachment,3
4/15/2024,Top Order Inquiry; gz -> vbs -> guloader,Attachment,3
4/16/2024,Shipping Invoice & AWB; 7z -> vbs -> guloader,Attachment,2

silence-is-best

Date,Summary ,Details,Email Payload Type,Users Targeted
3/1/2024,Malicious email campaign; morning,Re: lnvoice copy.; zip -> img -> wsf -> xworm,Attachment,8
3/4/2024,Malicious email campaign; morning,RE: ADVANCE TT SLIP // FEB 2024 SOA PAYMENT; zip -> originlogger,Attachment,4
3/4/2024,Malicious email campaign; morning,DELIVERY RELEASE ORDER Ref-no: <<A3_DB2TH84T.CNT>>; zip -> originlogger continued to 3/19,Attachment,4
3/4/2024,Malicious email campaign; morning,New PO - PO#2024EH001; rar -> originlogger,Attachment,4
3/4/2024,Malicious email campaign; morning,Inquiry & Orders; rar -> formbook,Attachment,3
3/4/2024,Malicious email campaign; morning,Payment Advice - Advice; img -> originlogger,Attachment,3
3/4/2024,Malicious email campaign; morning,ARRIVAL NOTICE EVER BEADY 0732-081S Ref-no|RE: Release Payment; zip -> originlogger,Attachment,16
3/5/2024,Malicious email campaign; morning,Invoice copy.; zip -> img -> wsf|vbs -> xworm continued to 3/7,Attachment,14
3/5/2024,Malicious email campaign; evening,Şubat

silence-is-best

Date,Details,Payload Type,Users Targeted
2/1/2024,SOA PAYMENT SETTLEMENT; r01 -> dbatloader -> remcos,Attachment,5
2/1/2024,Request for Quotation; z -> originlogger continued to 02/04,Attachment,8
2/4/2024,Re:New Order; 7z -> originlogger,Attachment,2
2/5/2024,Quote; z -> origin logger,Attachment,4
2/6/2024,AmBank Remittance Advice/SOA SETTLEMENT/BL-FEB-2024/APPROVED; tar -> modiloader -> remcos,Attachment,6
2/7/2024,Header from [email protected]|[email protected]; pdf -> wikiloader continied to 2/8,Attachment,162
2/8/2024,FW: Re: Quotation Request - Feb 2024 quotation.// New Supplier; lzh -> originlogger,Attachment,25
2/8/2024,RE: RFQ - 07.02.2024; xla -> doc -> vbs -> remcos,Attachment,3
2/12/2024,Payment remittance from Our Client/ Your Customer; 7z -> originlogger,Attachment,2

silence-is-best

Date,Details,Email Payload Type,Users Targeted
1/9/2024,Payment Failed: Update Your Payment Details to Avoid Subscription Interruption; pdf -> hagga -> orogin logger,Attachment,2
1/10/2024,Inquiry 37567 Appendices A, B, D, and E; 7z -> loader,Attachment,2
1/13/2024,Subjects contain Agency Appointment; zip -> snakekeylogger,Attachment,7
1/13/2024,FLF7992/22 // Shipment; zip -> snakekeylogger,Attachment,3
1/15/2024,Your UPS Parcel was delivered; gz -> originlogger,Attachment,2
1/15/2024,PO 4500082036; zip -> remcos,Attachment,3
1/15/2024,PDA and PORT INFO for 69 x 20' IMO CONTAINERS; zip -> snakekeylogger,Attachment,3
1/16/2024,Subjects start with Invoice from DSV: pdf -> zip -> js -> wikiloader,Attachment,369
1/17/2024,New Quotation 5665900481XXX024; rar -> oroginlogger,Attachment,3

silence-is-best

Src

101.100.168.8
106.201.232.211
112.165.98.84
113.160.178.233
115.238.191.246
116.249.154.224
117.4.201.133
122.171.19.108

silence-is-best

Date,Summary ,Details,Email Payload Type,Users Targeted
12/1/2023,Malicious email campaign; morning,Re: Inquiry; z -> originlogger,Attachment,4
12/3/2023,Malicious email campaign; morning,CV; doc -> formbook,Attachment,2
12/3/2023,Malicious email campaign; morning,Statement-1000276262; z -> originlogger,Attachment,4
12/4/2023,Malicious email campaign; morning,REQUEST FOR QUOTATION; gz -> formbook,Attachment,5
12/5/2023,Malicious email campaign; evening,URGENT PURCHASE ORDER No. 9104393019; gz -> originlogger,Attachment,3
12/5/2023,Malicious email campaign; morning,RE: Request for Urgent Quotation; gz -> formbook,Attachment,3
12/5/2023,Malicious email campaign; evening,Re: order December -06122023; 7z -> vbs -> guloader continued to 11/6,Attachment,13
12/5/2023,Malicious email campaign; evening,Payment Advice - Advice Ref:[A23Wo4XAk6xJ-IN] / Priority payment; rar -> originlogger,Attachment,4
12/5/2023,Malicious email campaign; morning,New Order /DB-078003417XXXXX; rar -> originlogger,Attachment,2