Special Update for #Emotet E3 Email Templates 10/31/2019 last updated 15:15 EDT
Looks like Ivan wants us to come to his Halloween party and since about 10:00UTC this morning he has been sending out invites with attached malspam docs(Enable Edition version) from the E3 botnet. We have seen both reply chain and generic based spoofing templates using the same lure. The body used in the generic and the reply chain malspam is basically the same inserted text. Here are the criteria:
From Addresses
Spoofed addresses
Subject Names
Happy Halloween
Halloween Party
Halloween party invitation
Halloween
Halloween invitation
Party invitation
(May be some sort of reply chain one)
Body Examples
______________________________
Dear Neighbors and Friends,
Please join us for a casual dinner party on Halloween night, Oct. 31, 2019 =
starting at 7:00 pm. Come and say hello to your friends and enjoy some foo=
d and drinks.
We are looking forward to a fun day and kindly respond with an email to mak=
e sure we have enough TREAT for you.=20
The Michael will bring drinks, thank you !
=0DDetails in the attached file.
Sent from my iPhone
______________________________
Dear Neighbors and Friends,
It is Halloween and time for TREAT OR TRICK.
Please join us for a casual dinner party on Halloween night, Oct. 31, 2019 starting at 6:30 pm. Come and say hello to your colleagues and enjoy some food and drinks.
We are looking forward to a fun day and kindly respond with an email to make sure we have enough TREAT for you.
Address and invite list in attachment.
______________________________
Good Afternoon,
It is Halloween and time for TREAT OR TRICK.
Please join us for a casual dinner party on Halloween night, Oct. 31, 2019 =
starting at 5:00 pm. Come and say hello to your friends and enjoy some foo=
d and drinks.
We are looking forward to a fun day and kindly respond with an email to mak=
e sure we have enough TREAT for you.=20
=0DParty address and invite list in attachment.
______________________________
Buenas tardes:
Envio mi CV para seguir con el proceso de selecci=C3=B3n de la vacante Jefe=
Administrativo.
Saludos....
Podiras confirmarme de recibido por favor.
______________________________
Good Afternoon,
Please join us for a casual dinner party on Halloween night, Oct. 31, 2019 =
starting at 5:00 pm. Come and say hello to your neighbors and enjoy some f=
ood and drinks.
We are looking forward to a fun day and kindly respond with an email to mak=
e sure we have enough TREAT for you.=20
Details in the attachment.
______________________________
Good Morning,
It is Halloween and time for TREAT OR TRICK.
Please join us for a casual dinner party on Halloween night, Oct. 31, 2019 =
starting at 7:30 pm. Come and say hello to your neighbors and enjoy some f=
ood and drinks.
We are looking forward to a fun day and kindly respond with an email to mak=
e sure we have enough TREAT for you.=20
The Michael will bring drinks, thank you !
Details in the attachment.
______________________________
Attachment Names
Address and invite list.doc
Halloween party invitation.doc
Happy Halloween.doc
Halloween invitation.doc
Halloween party.doc
Halloween.doc
Halloween Party.doc
Party tonight.doc
Party Invitation.doc
Party address and invite list.doc
We will update this more as time goes on with new indicators.
-@Cryptolaemus1