Special Update for Emotet E3 Email Templates 10/31/2019

Special Update for #Emotet E3 Email Templates 10/31/2019 last updated 15:15 EDT

Looks like Ivan wants us to come to his Halloween party and since about 10:00UTC this morning he has been sending out invites with attached malspam docs(Enable Edition version) from the E3 botnet. We have seen both reply chain and generic based spoofing templates using the same lure. The body used in the generic and the reply chain malspam is basically the same inserted text. Here are the criteria:

From Addresses

Spoofed addresses

Subject Names

Happy Halloween
Halloween Party
Halloween party invitation
Halloween
Halloween invitation
Party invitation
(May be some sort of reply chain one)

Body Examples

______________________________

Dear Neighbors and Friends,



Please join us for a casual dinner party on Halloween night, Oct. 31, 2019 =
starting at 7:00 pm. Come and say hello to your friends and enjoy some foo=
d and drinks.

We are looking forward to a fun day and kindly respond with an email to mak=
e sure we have enough TREAT for you.=20
The Michael will bring drinks, thank you !

=0DDetails in the attached file.

Sent from my iPhone

______________________________

Dear Neighbors and Friends,

It is Halloween and time for TREAT OR TRICK.

Please join us for a casual dinner party on Halloween night, Oct. 31, 2019 starting at 6:30 pm. Come and say hello to your colleagues and enjoy some food and drinks.

We are looking forward to a fun day and kindly respond with an email to make sure we have enough TREAT for you. 



Address and invite list in attachment.

______________________________

Good Afternoon,

It is Halloween and time for TREAT OR TRICK.

Please join us for a casual dinner party on Halloween night, Oct. 31, 2019 =
starting at 5:00 pm. Come and say hello to your friends and enjoy some foo=
d and drinks.

We are looking forward to a fun day and kindly respond with an email to mak=
e sure we have enough TREAT for you.=20


=0DParty address and invite list in attachment.

______________________________

Buenas tardes:

Envio mi CV para seguir con el proceso de selecci=C3=B3n de la vacante Jefe=
Administrativo.

Saludos....

Podiras confirmarme de recibido por favor.

______________________________
Good Afternoon,



Please join us for a casual dinner party on Halloween night, Oct. 31, 2019 =
starting at 5:00 pm. Come and say hello to your neighbors and enjoy some f=
ood and drinks.

We are looking forward to a fun day and kindly respond with an email to mak=
e sure we have enough TREAT for you.=20


Details in the attachment.
______________________________

Good Morning,

It is Halloween and time for TREAT OR TRICK.

Please join us for a casual dinner party on Halloween night, Oct. 31, 2019 =
starting at 7:30 pm. Come and say hello to your neighbors and enjoy some f=
ood and drinks.

We are looking forward to a fun day and kindly respond with an email to mak=
e sure we have enough TREAT for you.=20
The Michael will bring drinks, thank you !

Details in the attachment.
______________________________

Attachment Names

Address and invite list.doc
Halloween party invitation.doc
Happy Halloween.doc
Halloween invitation.doc
Halloween party.doc
Halloween.doc
Halloween Party.doc
Party tonight.doc
Party Invitation.doc
Party address and invite list.doc

We will update this more as time goes on with new indicators.

-@Cryptolaemus1