Phishing Attacks 8_4_2021

 




(1)

Sender ip

192.249.126.31

From

mail@policelife.com

Subject

EMERGENCY REPORT

Attachment

Download Report.08.04.2021.pdf.iso

MD5

98e3f0cfa4bd3db39bf04d0487aaf4a9

SHA256

fd864cf6ad8d6c05001173d47674c76fc1d9bc92f47b03dbdea5077f04a132af

Family

AgentTesla

 

(2)

 

Sender ip

93.125.22.95

From

pegas-1961@mail.ru

Subject

"=?UTF-8?Q?RE=3A_=D0=B1=D0=B0=D0=BD=D0=BA=D0=BE=D0=B2=D1=81=D0=BA?= =?UTF-8?Q?=D0=B8=D0=B9_=D0=BF=D0=B5=D1=80=D0=B5=D0=B2=D0=BE=D0=B4?="

Attachment

"банковский перевод pdf.zip"

MD5

7d12b3f345b5a69c742a0ff9d356a855

SHA256

1f1787cae61d24e9c6ad9baa35219d66b2c67973d43286b44cd07b5673d4bd62

Family

Formbook

 

(3)

 

Sender ip

45.156.22.105

From

DHL Express<invoicequerys@dhl.com>

Subject

DHL Notification

Attachment

DHL_Express_Shipment_Invoice_Confirmation_CBJ190517000131_74700456XXXX.arj

MD5

29a96632486950aed0800ebca0d71dda

SHA256

0611a407032cc160fd80bdadb7ffc3fdd2fd3a09fc31e2fd263624e0e7e6dd74

Family

AgentTesla

 

(4)

 

Sender ip

162.243.248.181

From

Nadir Dzananovic <office@marathon.co.rs>

Subject

Re: Re: bank transfer

Attachment

bank transfer.zip

MD5

6fc825a2f69349ddfc1e2a3f0465a0b7

SHA256

bd1316770c43fd3c9ca43f4035759f7dbf138c11a4e23effdf97201a8cf06548

Family

Formbook

 

 

(5)

Sender ip

75.119.154.209

From

Dhl Customer Support <mail@orderissued.xyz>

Subject

Delivery Failed

Attachment

Attachment.iso

MD5

4b01efab6972b7898af7e0eb62716a77

SHA256

24f4cf4250300c826fb80e2aebdd9e413f56d9ec5eda5fd5214e4dad9b517002

Family

RemcosRAT

 

(6)

Sender ip

208.109.80.58

From

Francisco Rico - Cobra Sales <info@psicoalcala.es>

Subject

Requesting A Quote

Attachment

Product List.gz

MD5

1de9cd0cbc1f665b959ddb33b84a2d9a

SHA256

c1ee9d13967b67852dd52969749439771274e97d4779eb8fde14bdcbd71848a8

Family

Unknown

 

 

 

 

(7)

Sender ip

162.144.38.36

From

PAY-U INT'L <sales9@oxy99.in>

Subject

PLEASE CONFIRM

Attachment

Message Body.img

MD5

11f774864744cbb5beccc117fe1204df

SHA256

7bd2e15ff319a761b48a511bcd7d8be41c8dcf2062183eb04dd03e78271113f6

Family

SnakeKeylogger

 

 

(8)

Sender ip

153.120.2.71

From

ahmad.khalil<mouhanaestryd@awalnet.net.sa>

Subject

New Tender RFQ OIL AND GAS TOOLS ADNOC PROJECT ABU DUBAI

Attachment

RFQ 100400806 SUPPLY.rar

MD5

df93940b230c4b7b1b101d583af18a2a

SHA256

5df1f0723ebb4f9000fcdc74fba201ec310139daff5a49543aa7bd3d43a8d70a

Family

SnakeKeylogger

 

 

 

(9)

Sender ip

80.68.177.43

From

Silvio Mazzocchetti <SMazzocchetti@ccsol.it>

Subject

Richiesta offerta / PRICE REQUEST

Attachment

OF556701.rar

MD5

2c74c8be2a4b36a91488b2ba3823f4ba

SHA256

6e9dcfdfe8a25d805c4bdc6e90f4cb9e32db3eeec568e3a999d8aee6a6a59a25

Family

Formbook

 

 

(10)

Sender ip

213.178.225.26

From

Gerald Howard <legal@moj.gov.sy>

Subject

INVOICE#ZQUNMVBSA

Attachment

ZQUNMVBSA.iso

MD5

f227d4cddbb3778b3585eb55301e2db2

SHA256

3b1717576370b4b032358b6b0a240217b45cacfa073508d80551647bb98fc063

Family

Vjw0rm

 

 

 

(11)

Sender ip

195.130.35.141

From

SRZ Rosario Corpa <rosario.corpa@ctransbolivia.com>

Subject

Nuevo orden

Attachment

Nuevo orden.zip

MD5

0cf319aac338858bb795606331b59d75

SHA256

c0ad412c53c697c92a3924e2532c2df0daf553e4d29175a97685e5dd2b3fe86e

Family

Formbook

 

(12)

Sender ip

187.217.245.25

From

Ideal Glass & Aluminium Works Sdn. Bhd.<emma.linderothh@dhl.com>

Subject

Purchase Order (Ref. IGA/PO/17493)

Attachment

Ref. PDF IGAPO17493.r07

MD5

867f5ff212f0698e76cab9f9152731f9

SHA256

9664c1d1ad01ca49f8cbad4d2551013683fd2e267b16351068bd9c750a4dcb78

Family

Formbook

 

 

 

 

(13)

Sender ip

109.232.221.141

From

DIXIT PATEL <info@advanceenterprise.in>

Subject

DIXIT PATEL <info@advanceenterprise.in>

Attachment

PO_NO.04-PRFTMUM210040.rar

MD5

09eee000f8d657796133b1d8c2e48247

SHA256

4db678a2cd9ba44f203c227024f2593a72cba91547a98788b121cff4903a7f2d

Family

Formbook

 

(14)

Sender ip

103.224.90.79

From

CETAL S.A.S. <contact@cetal.fr>

Subject

Richiesta di approvvigionamento

Attachment

PANORAMICA,pdf.iso

MD5

b0577e1e1c46ceeb64e62e4daed736e8

SHA256

9e7a8a6c07e77262159f6dc36632483692622e87f28aaf88d1da9336a33a8b4c

Family

SnakeKeylogger

 

 

 

 

 

(15)

Sender ip

167.99.105.80

From

"Logistics" <filmfiend@hanmail.net>

Subject

PO-RFQ # 097663899 NEW ORDER

Attachment

PO-RFQ 097663899 pdf .arj

MD5

ef0dc34ab28b3df30c25bbff400bd933

SHA256

f1bded88e9f7f34404fad5edf5b31b0ea7963b0b46a022d88f6eb4f3f7ab88b2

Family

Formbook

 

 

(16)

Sender ip

46.183.220.67

From

"sales<sale.sg@bruker.com>"

Subject

"#2345#Quotation for items list from bruker singapore Agents"

Attachment

"RE ITEM LIST.tar.gz"

MD5

98a65554a1c42005cfc3e3da661ddf66

SHA256

7a46a140079d1aa5b990531124c02994ff215004b12972b17d335bff5d4392dc

Family

AgentTesla

 

 

 

 

(17)

Sender ip

84.38.132.48

From

"Sandeep Gill" <accounts@gpbosch.com>"

Subject

"P/O"

Attachment

"P.O.rar"

MD5

481dbdc9b61bd7d35619bd2880397a7b

SHA256

cc4dab5542656e539e657ab6fe51c2a3f8299ece4098ead869ef1240526d367d

Family

AgentTesla

 

 

(18)

Sender ip

147.135.107.116

From

"<tony@excelpumps.co.uk>"

Subject

"Complete Certificate"

Attachment

"Complete Certificate.rar"

MD5

c8295cff73febab169fd24fa7a4c3425

SHA256

e0fcd83ffe9c39aebfa2e17d6bc7f76c3f8d06dcfed3bc3b753e8d436e09296f

Family

Formbook

 

 

 

(19)

Sender ip

180.214.239.97

From

Sunny Nie "<sales1@lekingwellness.net>

Subject

"Swift Copy"

Attachment

"Swift_Copy.rar"

MD5

b9a2581d013f7f25800e1f43747c8297

SHA256

390a81f1e882ad6f32a370f1bd4db3804d88567537f77457f1584a2c090e3dc4

Family

AgentTesla

 

(20)

Sender ip

103.82.24.104

From

Mr T.C. Lee/Choon Lian <trenwa84@singnet.com.sg>

Subject

REQUEST FOR QUOTATION FOR APRIL PRODUCTION

Attachment

TrenwaTradingPteLtd_AprilOrder_76012320.img

MD5

9ccf63827ec1a278c9ebd380e87daed6

SHA256

865c0cdd3bde9841d721ffd20f800789900bd31cf2cfe80ef284fe43589ed75b

Family

AgentTesla

 

 

 

 

(21)

Sender ip

45.156.25.122

From

DHL Express<invoicequerys@dhl.com>

Subject

DHL Notification CBJ190517000131

Attachment

DHL_Express_Shipment_Invoice_Confirmation_CBJ190517000131_74700456XXXX.arj

MD5

1ac9c130816d892b9e6a3871d613490e

SHA256

eb1d17b5d5fafb0920df971b1770aa86a509b7fbfa1c4ae3167b7c818758542d

Family

AgentTesla

 

(22)

Sender ip

185.249.199.79

From

Banca Comerciala Romana (BCR) <noreply@banca.com>

Subject

Confirmarea platii

Attachment

Confirmarea platii.pdf.ace

MD5

12d773108d84462fa85d5b911fdfc485

SHA256

d2c63dec41084df02addb40a690b31560d0d6b0e7f53a89d48a031b660e578ff

Family

AZORult

 

 

 

 

(23)

Sender ip

220.181.97.110

From

网站用 <sales@forbetter.cn>

Subject

RE: 19 Design for Quotation

Attachment

Photo.jpeg.img

MD5

0ab77f9d3d9d2c4fed40d3ee5b27e52d

SHA256

0f3af330eba5ea99326fad54ce9bea4d488d4e8ea721b56ceeab821137b9ad9b

Family

Formbook

 

(24)

Sender ip

78.30.254.44

From

Sales Manager <pmo@sevstar.net>

Subject

RE: 19 Design for Quotation

Attachment

"Quotation-4834898943949883.pdf.img"

MD5

bf8539ab48628dc7c5d699c2bc547d30

SHA256

6d80992a7b55b7e4555b5feb8b147cca18af1b154f23cef56aa21b0eec592b7b

Family

Formbook

 

 

 

 

 

(25)

Sender ip

23.254.229.17

From

DHL EXPRESS <import@cantera.xyz>

Subject

Shipment arrival notice

Attachment

Shioment Reciept.img

MD5

121a63915bcc804c5eff4df1bcb7f8ff

SHA256

9de3cd4ba640638f9613577ca2ec57ecef43ca481ada26df76cd38a0ad151e07

Family

Unknown

 

 

(26)

Sender ip

45.137.22.138

From

Roy Asghar <saslam@pseb.org.pk>

Subject

Re: 回复:Purchase Order

Attachment

PO.r00

MD5

a8a0cccebde4643cf5cdc950667fff84

SHA256

b448525900ab58d81ddfa0f0901d009503ddae60f8dcfe5270afc0b324ff3068

Family

Formbook

 

 

 

 

(27)

Sender ip

45.156.25.122

From

DHL Express<invoicequerys@dhl.com>

Subject

DHL Notification

Attachment

DHL_Express_Shipments_Invoice_Confirmation_CBJ190517000131_74700456XXX.arj

MD5

14ca4d229b227fddaa9ff403409eddca

SHA256

e48000bb4488cf61c74433f126a26c0f556a4a059524436029c6f372fa8d1157

Family

AgentTesla

 

 

(28)

Sender ip

185.121.120.165

From

Chunhua Biyu<postmaster@seasonmedical.co >

Subject

Export department:sales inquiry

Attachment

Quotation.zip

MD5

dfc61d7aa5d2f2d7bf68a08749d39324

SHA256

5bd732ff0414ba8034f553e571b6f2cbeafeeae28c552b364e7ffc49854163cf

Family

Formbook

 

 

 

(29)

Sender ip

74.6.133.228

From

Emad Salah <chrisdolas@yahoo.com>

Subject

Re: Re: New Purchase Order

Attachment

08042021New-PurchaseOrder.zip

MD5

139c6698ef6fe0b516141ef2ff2e2a33

SHA256

b3bc65bad2802d4d9e30fc08c245143998f32193521d347c406946cf6edc8b9a

Family

AgentTesla

 

 

(30)

Sender ip

23.254.229.53

From

DHL EXPRESS <delivery@dhlexpress.icu>

Subject

Shipment arrival notice

Attachment

shipping reciept.img

MD5

2a5104e22741c5e4e337aeba9beed4aa

SHA256

43ef0ef20029ecbeae07e496c57fa261aa27753e9450c405c92b68e05a74de29

Family

RemcosRAT

 

 

 

 

(31)

Sender ip

185.222.57.244

From

t.efremova@lidkon.by

Subject

QUOTE REQUEST

Attachment

PRODUCT_INQUIRY_PO_0009044_PDF.rar

MD5

de953dc61a6284efc33416822d675f02

SHA256

5e5b30bd0c14d47be60777b5abae640193b3adb1a1a3310c81c91aab2fac4b74

Family

SnakeKeylogger

 

(32)

Sender ip

37.152.93.84

From

Marko Gasic 2CL <info@dehonbv.nl>

Subject

Betaling advies

Attachment

Betaling_advies.iso

MD5

cf8973d403a8e2b5454ade61ed9bd4e2

SHA256

77e0c6a1e399f1c6ca9ef8fe18c7d9adb2996d979cabc68b5fbd48e17c0d3281

Family

Formbook

 

 

 

 

 

(33)

Sender ip

47.43.20.33

From

Amazon.com <tamhes@charter.net>

Subject

Your Amazon.com order #D01-9237793-8041853

Attachment

order-invoice-amazon-D01-9237793-8041853.DOCX.iso

MD5

9349d3f015a6ad0321b2f975d2987e1b

SHA256

2ce1829e18c3e38344bd6493db7a9bac7e3c9b49b8617c06d948b410dba31afe

Family

AsyncRAT

 

(34)

Sender ip

180.214.239.97

From

Sunny Nie "<sales1@lekingwellness.net>

Subject

Payment

Attachment

Payment _Advice (2).rar

MD5

ddd3db1fb03ecbcbb8256d0e7e457be5

SHA256

27095e0485ad91d2e8a2a2393c92f534f12b8f51372f9aef49f60ab91cefb861

Family

AgentTesla

 

 

 

 

(35)

Sender ip

185.222.57.157

From

"rashed@sumaco.ae"

Subject

RE:Request to URGENT REQUIREMENT!

Attachment

quotation.BZ2

MD5

8daedbd05aae05f259412b8fe284a102

SHA256

deaa5eafbe2d44e10b2570720113db086ce5af460ec573530bb8b00716f8f87a

Family

AgentTesla

 

 

(36)

Sender ip

185.222.57.216

From

kanya@cam-asean.com

Subject

Material dispatch details against your purchase order

Attachment

dispatch details.r00

MD5

6f7d2f141c2f600b1aca1f5fa9523898

SHA256

ec4cdc6c30b24171ed2427be8b77ceab3700a362536121d840c5620b79127908

Family

AgentTesla

 

 

 

 

(37)

Sender ip

180.214.239.97

From

Sunny Nie "<sales1@lekingwellness.net>

Subject

"SWIFT "

Attachment

"SWIFT.rar"

MD5

c1c1fc19ed3bba5127d300763ccfae7a

SHA256

ea2eb1dc943ae921cfe56c746bd5a24bd17ddf96f6f15595c4359044949a4464

Family

AgentTesla

 

(38)

Sender ip

185.222.57.171

From

kadircanatabek@hotmail.com

Subject

Invoice_893454

Attachment

SER09090899.Z

MD5

110b0f39b79fec17e3788bc0846071fb

SHA256

08ff8c346bc1528bb6bb9529b2b6403700616adb227e23998c4d8eb052231c30

Family

SnakeKeylogger

 

 

 

 

(39)

Sender ip

198.251.79.161

From

ANTONIO ARROYO <antonio.arroyo@corcimex.com>

Subject

RE: pago vencido de febrero y marzo#

Attachment

factura y datos bancarios.PDF.gz

MD5

ac290a6b06397cb40d1c7cb64379d345

SHA256

e03b5dabcbcc2bb1086dda3357f5c27ddd4de6a7cd4c85a4b0b85a5ee6fc9f0e

Family

AgentTesla

 

(40)

Sender ip

185.222.57.200

From

Marcus.Abraham<Marcus.Abraham@Ctscp.com>

Subject

FW: Invoice No. 36791 (CTE03)

Attachment

Invoice 36791 - CTE03.pdf.ace

MD5

154ffc89476b194d2660c0dc6c36b460

SHA256

f77e97a4e79b4d143ff3fb650ecc0dc2632039ccb354f0852740a7414d80306c

Family

AgentTesla

 

 

 

 

(41)

Sender ip

188.166.179.168

From

DAON TRADING AND LOGISTICS CO., LTD." <Jenniferle@daontnl.com>

Subject

Re: Shipping Advise on 18th April 2021

Attachment

Shipping Documents.xlsx

MD5

ab599dc3956c9e72ad6187bca6d7d783

SHA256

ce11e96fe93545cd9d381c440d7e172eebfe7c0e177c6485216313b144c415a3

Family

Formbook

 

(42)

Sender ip

168.95.6.59

From

Green.ERA Trading <Green.era7445@msa.hinet.net>

Subject

new order

Attachment

DYANAMIC Inquiry.xlsx

MD5

7590f977659a5cd174b0000a2530cd34

SHA256

df2d5a069d3e4a4516b14d6a64f6ec16e433cf883556ae1429d1e35c65ffe65f

Family

Formbook

 

If you wanna learn malware analysis you can check my YouTube channel I'm trying publish analysis of malware and some methods to analysis malwares.
Please don't forgot subscribe my channel Than you ♥  
YouTube channel 
https://www.youtube.com/channel/UCParXHaBXBmqRdHuVUg21pA

Comments

Popular posts from this blog

Sunburst Solarwinds Backdoor

Ragnarok Ransomware

Phishing Attacks 9_4_2021