4_7_2021 phishing attacks
(1)
|
Sender ip |
113.196.61.199 |
|
From |
"Jean Clark"
<service@m2.pay2go.com>" |
|
Subject |
"Payment Confirmation
04948392" |
|
Attachment |
"Payment Confirmation.img" |
|
MD5 |
252556c05551372633042fcc7b142d54 |
|
SHA256 |
a20ab7a4f9d752a616bf2fee4c0aab0565ac9d8e442b483cb8eaa1e726103405 |
|
Family |
Formbook |
(2)
|
Sender ip |
198.251.79.161 |
|
From |
"Gerente de carga de DHL
<pagos.fletes@dhl.com>" |
|
Subject |
"=?UTF-8?Q?Confirmaci=C3=B3n_de_env=C3=ADo_DHL_Express=23?=" |
|
Attachment |
"Documentos de
DHL..PDF.....gz" |
|
MD5 |
e5ac41a9c6bb08961ec44ad4b201e2a8 |
|
SHA256 |
908b44db519efa5b664ade3863effe7d10d0e71498a57c24cb898e295cdaa49e |
|
Family |
AgentTesla |
(3)
|
Sender ip |
139.99.167.178 |
|
From |
"Greg
<gkontouzoglou@emproslines.com>" |
|
Subject |
"RE: OVERDUE INVOICE" |
|
Attachment |
"JANUARY OVERDUE
INVOICE.arj" |
|
MD5 |
6e74ee737021356a410d16ee3f974205 |
|
SHA256 |
01a0edfce737d16102372ac1228f4095a3bdab926ecbccf64b452a4e9972a59a |
|
Family |
RevCodeRAT |
(4)
|
Sender ip |
199.10.31.238 |
|
From |
"Roy Asghar <saslam@pseb.org.pk>" |
|
Subject |
"=?UTF-8?B?UmU6IOWbnuWkje+8mlB1cmNoYXNlIE9yZGVy?=" |
|
Attachment |
"PURCHASE ORDER.gz" |
|
MD5 |
f8f00ad041221c5225fb1487b0bfff72 |
|
SHA256 |
cef4f9e5b0c16f4e0778d04dff1616f74408682c923821aaf9aee9c47b867535 |
|
Family |
Formbook |
(5)
|
Sender ip |
199.10.31.238 |
|
From |
"Kathy
<Kathy@oceanstar-inc.com>" |
|
Subject |
"Payment Confirmation // Swift
Copy" |
|
Attachment |
"IMAGE01.gz" |
|
MD5 |
12f29988615ba1b851b1b5a528f446fd |
|
SHA256 |
549f145325d458b0f9f66368926ea22167fb6825f7c5146e68361c28071179c9 |
|
Family |
Formbook |
(6)
|
Sender ip |
159.65.108.171 |
|
From |
"sg.payment.operations-jpmorgan
<sg.payment.operations-jpmorgan@335.eryfj.ml>" |
|
Subject |
"Remittance Information" |
|
Attachment |
"SG1_000000123205044_1.pdf.gz" |
|
MD5 |
a8719cafb919bb69ea5928611d748c8f |
|
SHA256 |
8b0b16714efce9bf5433abf0aa20790d662b5c456f56e518075d78084763d94e |
|
Family |
AgentTesla |
(7)
|
Sender ip |
159.65.108.171 |
|
From |
"sg.payment.operations-jpmorgan
<sg.payment.operations-jpmorgan@335.eryfj.ml>" |
|
Subject |
"Remittance Information" |
|
Attachment |
"SG1_000000123205044_1.pdf.gz" |
|
MD5 |
a8719cafb919bb69ea5928611d748c8f |
|
SHA256 |
8b0b16714efce9bf5433abf0aa20790d662b5c456f56e518075d78084763d94e |
|
Family |
AgentTesla |
(8)
|
Sender ip |
185.222.58.104 |
|
From |
Allen.nilvik@163.com |
|
Subject |
Urgent Inquiry from Nilvik
International |
|
Attachment |
Specification 01012_pdf.7z |
|
MD5 |
2479d696a8cc14b898ab0b02bbfde8e4 |
|
SHA256 |
83a946ca558da288b427ca8efcf9a557632641fb0b8c3e278d014646ea7aac1e |
|
Family |
Unknown |
(9)
|
Sender ip |
193.252.22.212 |
|
From |
info <noreply11003263@operacrorg.onmicrosoft.com> |
|
Subject |
Télécharger votre relevé fiscal |
|
Attachment |
ID638927302.js |
|
MD5 |
6c71cbaba924e6472a18f002d9f84cb8 |
|
SHA256 |
b1cbe8f45e1df356c8fab495500f1476298ffedce26cabe3b67a7e8f878f72c3 |
|
Family |
Unknown |
(10)
|
Sender ip |
45.133.1.167 |
|
From |
afkim kimya <satis@afkim.com.tr> |
|
Subject |
Re: Yeni sorgu |
|
Attachment |
doc20192910887888001990.r00 |
|
MD5 |
02af62d99e4813a452be33a859fc9e8d |
|
SHA256 |
9221fe9d8b10dded0ffe2545b8e249b3110834324ae3fff763066f944454473b |
|
Family |
SnakeKeylogger |
(11)
|
Sender ip |
91.212.89.55 |
|
From |
namangan@akmt.uz |
|
Subject |
Fwd: B/L is wrongly |
|
Attachment |
B of L - way bill return.rar |
|
MD5 |
568fa7becac49bd0989b0aace4ed86d0 |
|
SHA256 |
df1f19f5e23dfa70466d8fc1df2ca5e699cdbe7a2c83e077914f4ec74445088e |
|
Family |
Formbook |
(12)
|
Sender ip |
203.133.181.17 |
|
From |
Jaeho Lee <coat8023@daum.net> |
|
Subject |
KHE RFQ No. PG6432 PROJECT Reactor/
Heat exchangers/ Materials/Equipment _KOC JURASSIC PRF Algeria |
|
Attachment |
PG6432 KHE SHELL-RFQ-Project.cab |
|
MD5 |
44a7fe299bb64d278bb22d6256c651e0 |
|
SHA256 |
2ccd14ce326ef6916b4d7daeb220bd498ca46f52c0f4ddd1855f21cd984221cc |
|
Family |
Formbook |
(13)
|
Sender ip |
160.119.102.133 |
|
From |
Martin Václavek
<cc.goh@mizuwell.com> |
|
Subject |
URGENT ORDER REQUEST |
|
Attachment |
RFQ4734.zip |
|
MD5 |
b3c6206c87d1bd8676efb1765c8c0989 |
|
SHA256 |
4c3bbfc3b926616efe05cab622cd9a8f270a2223a5dc8911900577947cc5d087 |
|
Family |
AZORult |
(14)
|
Sender ip |
167.99.239.109 |
|
From |
Damia/Navegacion SHIPPING
<chew@cidc.com.my> |
|
Subject |
RE: DRAFT BL: BP899088885776 / NEW
SHIPMENT (Draft Dispatch Documents) |
|
Attachment |
BL84995005038483.zip |
|
MD5 |
5c3c47d30b92f01c319250946ae86961 |
|
SHA256 |
2c23f2c834f6d9fe89f0cde03a516eea04b945b464eae3f042e0a47fb2390a05 |
|
Family |
Formbook |
(15)
|
Sender ip |
192.249.126.31 |
|
From |
mail@policelife.com |
|
Subject |
EMERGENCY REPORT |
|
Attachment |
Download Report.06.05.2021.iso |
|
MD5 |
90c76319bb8aeca124f93cce3f457fde |
|
SHA256 |
4ceefacac5bb3d0f14563d1a884ddc4c48d41b4aa3f2a573e3449fc4f2f635f0 |
|
Family |
Unknown |
(16)
|
Sender ip |
103.125.190.192 |
|
From |
Natalie Tan NTAN@vikingcorp.com |
|
Subject |
PROFORMA INVOICE FOR PAYMENT URGENT!!! |
|
Attachment |
PROFORMA INVOICE.zip |
|
MD5 |
099aaca5ff44fcc163a8fefebabc58c8 |
|
SHA256 |
d26e919fb8d6afdb6c24176ae3c33672e24a7dc9a759b9493b8a88c027613016 |
|
Family |
SnakeKeylogger |
(17)
|
Sender ip |
111.93.252.4 |
|
From |
zheng yunxia(鄭蘊俠) <zhengyunxia@jctrans.net> |
|
Subject |
Re: 答复: 答复 // New Order //93478944//1*20'GP//PTSHASE20060117 |
|
Attachment |
New Order.gz |
|
MD5 |
0b60cb4adbd7eee0f3b9a4fb32dc8dfa |
|
SHA256 |
dca570fb7c9d0514639060f7230cf92f8b851c071bebe8d79b66ad5d8bbe1481 |
|
Family |
Formbook |
(18)
|
Sender ip |
185.121.120.26 |
|
From |
PRE-PAYMENT SWIFT COPY FOR INSTALLMENT <sales6@joyiqi.com> |
|
Subject |
SALINAN SWIFT PRA-PEMBAYARAN UNTUK
PEMASANGAN |
|
Attachment |
SALINAN SWIFT PRA-PEMBAYARAN UNTUK
PEMASANGAN.iso |
|
MD5 |
3a20237e5ee90c6cf326477daee17bd8 |
|
SHA256 |
d0d8d8eb59807b54198aa881e835099cfa7abf9a1f8f28751862264931741f04 |
|
Family |
Formbook |
(19)
|
Sender ip |
43.252.212.107 |
|
From |
Damia/Navegacion SHIPPING <contactus@bloommaze.com> |
|
Subject |
RE: DRAFT BL: BPGUC21001161 / NEW
SHIPMENT (Draft Dispatch Documents) |
|
Attachment |
BL836477488575.zip |
|
MD5 |
c8f8c392bd5d2d53168ec6ac9c5d62dd |
|
SHA256 |
a34d50edbd87c99b41bc37b2059011d778a15eb07ab66065e8eed5cd15f378fa |
|
Family |
Formbook |
(20)
|
Sender ip |
112.213.89.104 |
|
From |
Nguyen Thi Kim Ngan <sales.ngannguyen@khanghy.com.vn> |
|
Subject |
NEW APRIL QUOTATION |
|
Attachment |
APRILQUOTATIONQQO2103060_SAMPLES_KHANG
HY_CO_CORPORATION.arj |
|
MD5 |
ddd5b29a63ccca6f031d825f09f3bec8 |
|
SHA256 |
612e53f0e6a50c86e316bdc0600ddb89f7e5b51a26c879248adcc59c65524ef9 |
|
Family |
AgentTesla |
(21)
|
Sender ip |
154.16.145.158 |
|
From |
DHL Express Shipment <dcc@dccsa.co.za> |
|
Subject |
AWB: #76659011 DH-EXPRESS SHIPMENT |
|
Attachment |
DHL_SHIPMENT_ADDRESS_CONFIRMATION_00000001.zip |
|
MD5 |
b3a2891aa9ed727b531fab9055550c4e |
|
SHA256 |
526bc2e829b771d094b6c6d8a17aa2b8111e5291ca345a313a56fecd7a63b7c2 |
|
Family |
AgentTesla |
(22)
|
Sender ip |
89.31.76.247 |
|
From |
Pham Thanh Tung <fo@gachmpdtamt.com> |
|
Subject |
RE RE: RE RE: RE RE: RE RE: RE RE: RE
RE: order |
|
Attachment |
taiwan.zip |
|
MD5 |
2e4785bd10fa399ea41c1eb38fff3edc |
|
SHA256 |
1317178c535deac0cd5402fb944ed65542281da1a9d1c4e37c65287d108e6b0e |
|
Family |
Formbook |
(23)
|
Sender ip |
103.89.91.236 |
|
From |
shahabamorico@gmail.com |
|
Subject |
RE;REQUEST FOR QUOTATION |
|
Attachment |
QUOTATION.zip |
|
MD5 |
144ed9c7b681b58e6fb69a86aedbb859 |
|
SHA256 |
af345ba105bdf6a7015248d032984f79afef8b19e700235578522d279322801b |
|
Family |
Unknown |
(24)
|
Sender ip |
203.159.80.43 |
|
From |
Accounts Dept <accounts@judingtech.com> |
|
Subject |
Fw: Re: Payment Advice / Bank Details |
|
Attachment |
Payment Advice.jpg.zip |
|
MD5 |
6e0beff439e2905df31ab9d6a0d076e3 |
|
SHA256 |
2633901f3823c7c26a73a2041eb78cbe6f7a8c4afdcedea30cd840e515dc76f7 |
|
Family |
RemcosRAT |
(25)
|
Sender ip |
185.222.58.148 |
|
From |
Finance Department <finance@jonyeng.com> |
|
Subject |
FW: SWIFT Transfer (103)
000OUTQ080519103 |
|
Attachment |
000OUTQ080519103.pdf.7z |
|
MD5 |
e3dfc7314c31a6ffb488a9325f62ce94 |
|
SHA256 |
d8eba15b26d5652ed7cf6a67ec0f3b847fe7179aafdd414d092d25163eed9b3e |
|
Family |
Unknown |
(26)
|
Sender ip |
185.121.120.163 |
|
From |
postmaster@axxin.co |
|
Subject |
PO#98796427521 |
|
Attachment |
PO.zip |
|
MD5 |
6048f1059131a6c980fdba17c9053818 |
|
SHA256 |
180ecd0e9a58eb360d20333cbb0778ef8bdfbd31a1512b257256bf850dd41ff2 |
|
Family |
AgentTesla |
(27)
|
Sender ip |
104.168.202.229 |
|
From |
jrt@carasollimited.pw |
|
Subject |
CARASOL LIMITED GROUP PRESENTATION |
|
Attachment |
CARASOL LIMITED GROUP PRESENTATION.rar |
|
MD5 |
a71d3dabb71f27cc04a540bc810be5e2 |
|
SHA256 |
64bcb9c87f3e818a09349cbacce624de54bf7668e0d340912a017b5e9a35efe6 |
|
Family |
AveMariaRAT |
(28)
|
Sender ip |
185.121.120.165 |
|
From |
Chunhua Biyu<postmaster@seasonmedical.co > |
|
Subject |
Export department:sales inquiry |
|
Attachment |
Quotation.zip |
|
MD5 |
dfc61d7aa5d2f2d7bf68a08749d39324 |
|
SHA256 |
5bd732ff0414ba8034f553e571b6f2cbeafeeae28c552b364e7ffc49854163cf |
|
Family |
Formbook |
(29)
|
Sender ip |
185.121.120.165 |
|
From |
Chunhua Biyu<postmaster@seasonmedical.co > |
|
Subject |
Export department:sales inquiry |
|
Attachment |
Quotation.zip |
|
MD5 |
dfc61d7aa5d2f2d7bf68a08749d39324 |
|
SHA256 |
5bd732ff0414ba8034f553e571b6f2cbeafeeae28c552b364e7ffc49854163cf |
|
Family |
Formbook |
(30)
|
Sender ip |
43.252.212.107 |
|
From |
Damia/Navegacion SHIPPING <contactus@bloommaze.com> |
|
Subject |
RE: DRAFT BL: BPGUC21001161 / NEW
SHIPMENT (Draft Dispatch Documents). |
|
Attachment |
BL8846545545363.zip |
|
MD5 |
3a3c31db80f66c72d3d2b955b36d8362 |
|
SHA256 |
90d344562158255d4b094a2e157cd1196b4248bf01584d6c10f1ae33caf9ac70 |
|
Family |
Formbook |
(31)
|
Sender ip |
104.168.200.175 |
|
From |
Antonella Lattarulo <jrt@dropboxer-asia.pw> |
|
Subject |
Arifashayan 2020 06_04_RFQ |
|
Attachment |
Arifashayan_2020_06_04_RFQ.rar |
|
MD5 |
5d707a4553f073324b1b849b3f891e89 |
|
SHA256 |
63bf325ba69681027e3ecfe828b993abe799ed0bc43c15617668abbdaa9db55b |
|
Family |
AveMariaRAT |
(32)
|
Sender ip |
45.95.168.230 |
|
From |
Marina Malzew <info@blazefierce.live> |
|
Subject |
Re: RFQ- PO#-33202100 |
|
Attachment |
RFQ040820.zip |
|
MD5 |
ed5ff6866b115f070e80160b8d10bf0f |
|
SHA256 |
d4abf50f9fd0aee8e6ada5a478e2d84d37d010ed92239705a7438f4a3c9a5435 |
|
Family |
AgentTesla |
(33)
|
Sender ip |
8.36.41.118 |
|
From |
DEKRA Industrial (Guangzhou) Co., Ltd. <info@dekra.com.cn> |
|
Subject |
new PO (ref: #1422) DEKRA // PI:
Confirmation |
|
Attachment |
Confirmation_1422 DEKRA order,pdf.iso |
|
MD5 |
35b9c2fb113b341da994a9eeeb65e920 |
|
SHA256 |
b2886305c4aa1e643de11d41f285e4de2712801e20e5030a32c36c62f6f1f3d7 |
|
Family |
SnakeKeylogger |
(34)
|
Sender ip |
179.96.211.130 |
|
From |
Tomomi YADA(Ms.)<postmaster@avail-tokyo.co.jp> |
|
Subject |
05.04.2021 PAYMENT SWIFT |
|
Attachment |
swift copy.rar |
|
MD5 |
c29756a81b175c8a45063f034614200c |
|
SHA256 |
77d633bb04f17dd1a4fd81ffed1f20b7e2844a0f67f16b57a6c565e429d3fc3d |
|
Family |
Unknown |
(35)
|
Sender ip |
82.223.243.188 |
|
From |
李安妮 <support@elpeloton.net> |
|
Subject |
RE: Reservation |
|
Attachment |
รายละเอียดบัตรเครดิต.rar |
|
MD5 |
de58e733f0feac7c8d0f9b5dec828185 |
|
SHA256 |
ae544fc1c3293473d4261360fa739819decfe531c900f085e555fb4afaf15847 |
|
Family |
Formbook |
(36)
|
Sender ip |
165.232.130.32 |
|
From |
Ying TANG <ying.tang@rina.org> |
|
Subject |
Outstanding invoices |
|
Attachment |
Outstanding invoices.rar |
|
MD5 |
c4493e8cbd3c6718b4012ac630724c35 |
|
SHA256 |
bc53bbf6cd255b5bf3b06b5234fb1c733e1fbbc022828e20805fb89ea451e666 |
|
Family |
AgentTesla |
(37)
|
Sender ip |
111.90.139.164 |
|
From |
Chery Ch <Cherych@hbtovs.com> |
|
Subject |
Attached selected items and confirmed
copy of Order and Sales Contract Draft for your reference. |
|
Attachment |
ORDER6798ERA-LBT.rar |
|
MD5 |
b1f71045eff99bbdc181370889664581 |
|
SHA256 |
e2054a668969a178ed46aa1de4630da4d397bd2cdb0cef98d4cabba80403ed08 |
|
Family |
Formbook |
(38)
|
Sender ip |
143.198.208.26 |
|
From |
Savelie Raischi <contact@samigo-trade.com> |
|
Subject |
Previous inq |
|
Attachment |
QUOTATION
JANUARY_ALFA-NISTRU_20210129-20293083020234.lzh |
|
MD5 |
a06c39d7735e3d7cb21fa826d3fe25f1 |
|
SHA256 |
edec093ec0a70e58da54a9020c8f55298d3425e4c597fead5c96f94b7dba0a80 |
|
Family |
AgentTesla |
(39)
|
Sender ip |
87.237.54.126 |
|
From |
MEGA ICBC Singapore Branch <OBSSGP@megabank.com.tw> |
|
Subject |
Credit Advice - Global E-Banking
Transaction, CUST ID:c431xxx0, |
|
Attachment |
Credit Advice -TT6635993652908.PDF.img |
|
MD5 |
e67df1e7a4ac3610c63ebf43ce57c328 |
|
SHA256 |
9b96d29bf6c5183b4ab838883d42b2bf936eee44dd1a714240ce21277b85bde7 |
|
Family |
AZORult |
(40)
|
Sender ip |
87.237.54.126 |
|
From |
MEGA ICBC Singapore Branch <OBSSGP@megabank.com.tw> |
|
Subject |
Credit Advice - Global E-Banking
Transaction, CUST ID:c431xxx0, |
|
Attachment |
Credit Advice -TT6635993652908.PDF.img |
|
MD5 |
e67df1e7a4ac3610c63ebf43ce57c328 |
|
SHA256 |
9b96d29bf6c5183b4ab838883d42b2bf936eee44dd1a714240ce21277b85bde7 |
|
Family |
AZORult |
(41)
|
Sender ip |
198.251.79.161 |
|
From |
"ANTONIO ARROYO antonio.arroyo@corcimex.com” |
|
Subject |
"RE: pago vencido de febrero y
marzo#" |
|
Attachment |
"factura y datos bancarios.PDF.gz" |
|
MD5 |
73bd07ee6d0c65ad0133fd69d3dd32ad |
|
SHA256 |
610842f5e809996227396485a6577f350a0402cacab2ab431854ed97b83f5bc0 |
|
Family |
Unknown |
(42)
|
Sender ip |
198.251.79.161 |
|
From |
"ANTONIO ARROYO antonio.arroyo@corcimex.com” |
|
Subject |
"RE: pago vencido de febrero y
marzo#" |
|
Attachment |
"factura y datos bancarios.PDF.gz" |
|
MD5 |
73bd07ee6d0c65ad0133fd69d3dd32ad |
|
SHA256 |
610842f5e809996227396485a6577f350a0402cacab2ab431854ed97b83f5bc0 |
|
Family |
Unknown |
(43)
|
Sender ip |
184.106.54.73 |
|
From |
Ryan Rangel <lance.elpidama@bigfrog.com> |
|
Subject |
94733253533 LRMS PO# LRMS |
|
Attachment |
Track1Z16301.doc |
|
MD5 |
3b293561854d9ad8d99f8cf2f37ec521 |
|
SHA256 |
1e472b9de49871cbf3a381b560312a55163a196213329fdae34f4bbae6dd9d20 |
|
Family |
Unknown |
Malware Analyst : Mahmoud El Menshawy
Contact me : mahmoudmorsy372@gmail.com
Comments
Post a Comment