Phishing Attacks 21_4_2021

 












(1)

Sender ip

45.137.22.71

From

"Jashpal Singh <stantech@eim.ae>"

Subject

"RE: LPO-SCREEN MESH"

Attachment

: "LPO PRECISION MESHES 2352104321QQ.pdf.r11"

MD5

740d0fb7a4addd333ba056dea2fabf3a

SHA256

528af553a32a89601588f39b35e8b2714cd479bc47648b007a564136485e3e0e

Family

Formbook

 

(2)

Sender ip

195.231.66.125

From

"Nguyen Phuong Thuy <thuy.sa@ctcbio.com.vn>"

Subject

"New Order"

Attachment

(New order - List of New Order).zip

MD5

32246920e52fd4ef5cc1bd49811a2344

SHA256

40a337fe26c8929fa7d4cb2c750b03d160d1ce1addc9ea0f7abfb71c242a07f0

Family

ModiLoader

 

(3)

 

Sender ip

185.136.163.190

From

"Louis Morgan Groups<osoriandres33@ymail.com>"

Subject

"Order List"

Attachment

"Order List.zip"

MD5

c3c073bdc64b2ae06490024e9f0d1c63

SHA256

823f97c8ef07b2edfa84d898cf7987a0c18bc742fb458aeb99c97f49ad3fe64b

Family

AgentTesla

 

(4)

 

Sender ip

45.137.22.71

From

"Echo Wu <quinn.gtf@gmail.com>"

Subject

"update prices of attached items"

Attachment

"update order of attached items.r00"

MD5

8f0088d768489196c279a1c8adc70a20

SHA256

a32bb58209626c22868278a90a0956495039289cf88d33d085419b9a8259266f

Family

Unknown

 

(5)

Sender ip

185.222.57.157

From

"info@pesqueracristiansen.com"

Subject

"RE: BALANCE TRANSFER SWIFT COPY.."

Attachment

"SWIFT COPY..rar"

MD5

cf8fe5bfba132a425f4b79f1247e8554

SHA256

181ee3a7d7eed5331b58011e1088533b45734c5f7928dd4b4cc78ac3def5f90b

Family

AgentTesla

 

(6)

Sender ip

185.222.57.171

From

"n.kharaishvili@ltb.ge"

Subject

"order #127"

Attachment

"NA090900000.LzH"

MD5

0b934403f656857cffcff32823b6f8de

SHA256

d0dde788e773c61239053ee6dffff5e83043310ef27efac0f6d8275af0971b57

Family

NanoCore


(7)

Sender ip

45.137.22.71

From

"T. HALK BANKASI<EKSTRE@halkbank.com.tr>"

Subject

"T.HALK BANKASI A.S.Hesap Ekstresi"

Attachment

"Halkbank,doc 00100210210.r11"

MD5

9a900a84e85e6bfe1ac6e55873aa262a

SHA256

256ddf8556d759c829d9ebfb85e2ec242b3bf94d38f2cbf9edfb5c780973a256

Family

Formbook

 


(8)

Sender ip

142.4.18.137

From

"cindy@medicalstaffinginnovations.com"

Subject

“PI OUI899484 BOX .PAKE"

Attachment

"OUI.899484... BOX.gz"

MD5

842a0115077cd223a12d31d352498924

SHA256

92ec45e9b52f0cb624e34c317a8c4f122acb9ba62be1ff6088625d96e555ddb8

Family

unknown

 

 

(9)

Sender ip

185.222.57.157

From

"info@pesqueracristiansen.com"

Subject

"RE: BALANCE TRANSFER SWIFT COPY.."

Attachment

"SWIFT COPY..r00"

MD5

f489aa535f8096ab6b278616ef4c4484

SHA256

8e47a1d341da073d6d19310578ee44144f0d86d1b50613b631ec0a2688204ed1

Family

AgentTesla

 

 


(10)

Sender ip

185.222.58.156

From

"=?UTF-8?B?xLBNTcSwQg==?= <immib@immibhaber.org>"

Subject

"Payment_Swift_TT_Copy_Original.pdf ///Re: Instructions for Payment"

Attachment

"Payment_Swift_0096986854748574.r00"

MD5

8303923a596fd9cbcc7ffe4caa2ea8c8

SHA256

17967badb8bb0e2240386e286f05c9c00bcd74a991f5230ea20b2db610d8cc07

Family

SnakeKeylogger


(11)

Sender ip

185.222.57.162

From

"Naney Jasmin Estrada(Ms.)<info@midwaywholesalebz.com>"

Subject

"RE:Proforma IO108090"

Attachment

"Proforma IO108090.zip"

MD5

4885ff083ce141b9ca9110bff8219723

SHA256

b2eadc92f226dcdda1217fc2548ccba1479c8e50bd24b25123215a926aacf7a5

Family

AgentTesla

 


(12)

Sender ip

45.156.23.236

From

"Steve Park" <nelle@gusikowski.ml>"

Subject

"RE: Overdue Charge Payment"

Attachment

"Bank Details.rar"

MD5

7a8c59a4794d9ec5a8b0256f5e339bd5

SHA256

3e4dfe7c5416c432107685e308c803d888df1f5d78949a11c535ee926216c635

Family

SnakeKeylogger

 

(13)

Sender ip

51.89.208.80

From

"emily.r@appraisal-property.com"

Subject

"Appraisal Loan Report."

Attachment

"Appraisa-reportl11002275444900.zip"

MD5

e8ca9498986b1c304ad639874335339f

SHA256

6fdcc4b886c1ddcd5a76bfb4f8c79cf39f7c3c3fbe08cee92fa5a8eeafc57e43

Family

RemcosRAT

 

 

(14)

Sender ip

103.133.105.111

From

"Atina Wu <sales@gmeesolar.com>"

Subject

"*URGENT SUPPLY* QUOTE B1020363"

Attachment

"QUOTE B1020363.PDF.gz"

MD5

adfcfecea283e97f3cda3be4baffa7e9

SHA256

104f4489ec8b1b693b839dc39082f5f07e569be7728dbd3e0d8172a76f6dce68

Family

Formbook

 


(15)

Sender ip

45.137.22.57

From

"surendra@saisanket.com"

Subject

"RE: PAYMENT COPY"

Attachment

"Payment.zip"

MD5

d6ea4160f408cce8aae4a84d37d9e921

SHA256

40697fea925326e0b55469750354352c0c7d36f7abe00699e013e55e9afeae2d

Family

AgentTesla

 

 

(15)

Sender ip

185.222.57.90

From

"<quality@amproinc.in>"

Subject

"GS_ PO NO.186/2021"

Attachment

"GS_ PO NO.1862021.zip"

MD5

1eadad01709a0294e51f5b64462059fc

SHA256

399a8f899ba8d8ef02ecfd588fcbe4c0e85d59d8a51bb3127dc3e5fc451d278b

Family

AgentTesla

 

(16)

Sender ip

93.189.41.228

From

"BlueLinx Holdings <Watson@localmoverquotes.com>"

Subject

"DocuSign: Equipment #9517"

Attachment

"inv_1021910698_364846394.rar"

MD5

5ad1b1fa3cff6f806797b77545461fd0

SHA256

730deb695698a67f2b135c9b836b112f03d2b94ad9cc1bb9d38513b2a8bbf7bd

Family

Quakbot

 

(17)

Sender ip

82.194.90.139

From

"sekretary <bogdanov_BY@mail.ru>"

Subject

"=?UTF-8?Q?=D1=81=D1=87=D0=B5=D1=82-=D0=BF=D1=80=D0=BE=D1=84?=

=?UTF-8?Q?=D0=BE=D1=80=D0=BC=D0=B0?="

Attachment

"счет-проформа pdf.zip"

MD5

d625f80e4f8359aa969eef872133ad03

SHA256

083a56cd6197597aae81782b47d6aaead5b6ec08245b6603845aaa425645dd1e

Family

FormBook

 


(18)

Sender ip

62.113.202.77

From

"Rahmatullah khan"<sales@smoresteel.com>"

Subject

"Update of PI AAAQ pending orders0308 D2101002610 air shipment"

Attachment

"pending orders0308 D2101002610 pdf.7z"

MD5

7d9224e610eab56f6a2276a8f31f8cc7

SHA256

c76e376abdeb8103dc00f7c3b68cdf6a685cc5578269b83edc249fa0693cb973

Family

FormBook

 

(19)

Sender ip

93.189.41.228

From

"BlueLinx Holdings <Watson@localmoverquotes.com>"

Subject

"DocuSign: Equipment #9517"

Attachment

"inv_1021910698_364846394.rar"

MD5

5ad1b1fa3cff6f806797b77545461fd0

SHA256

730deb695698a67f2b135c9b836b112f03d2b94ad9cc1bb9d38513b2a8bbf7bd

Family

Quakbot








Comments

Popular posts from this blog

Sunburst Solarwinds Backdoor

Ragnarok Ransomware

Phishing Attacks 9_4_2021