Phishing Attacks 24_5_2021

 

(1)

Sender ip	104.129.30.165
From	"Waleed Farouk <w.farouk@economic-group.com>"
Subject	“Quotation Middle East"
Attachment	"Final Quotation.pdf.z"
MD5	5edce790dbf0f2111f96fff961215d96
SHA256	030c446ac1fac992dadf50c3926a07f9135232b6fbb0eda2ac40701d355567cd
Family	unknown

 

(2)

Sender ip	31.210.21.118
From	"zhangxh@coscohe.com.cn"
Subject	"Fwd: Required Quotation"
Attachment	"PO#975072.rar"
MD5	c0abf085a4e6bd1a6c7dea1e08c14205
SHA256	54c52915b9a166cc18f39c86d2052699397ae13bd68b2e920d99c05edb17e836
Family	SnakeKeylogger

 

(3)

 

Sender ip	89.40.173.102
From	"shabbir" < shabbir@alhatim.com.pk>"
Subject	"Purchase Order - PT-110/21"
Attachment	"Purchase Order - PT-110/21"
MD5	b73b9452fe8e2a08ae3ce442c6b2e268
SHA256	14be1b927fba34318fdaa1b2a6c2090e30ecf3da8edc1d94553e15050282fcce
Family	SnakeKeylogger

 

(4)

 

Sender ip	45.137.22.149
From	"sale@yichaobio.com"
Subject	"RE: NEW ORDER (160336-1001461)"
Attachment	"new purchase order.r00"
MD5	d1900b639ad9e043b1fdf368da5db70a
SHA256	0951f2acee4b1466ac04f11c815dae1c4888cdf37646e32c6db154e05f6c0b10
Family	AgentTesla

  If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(5)

Sender ip	187.217.245.25
From	"Aseem Narang medical Zhangjiagang Co., Ltd Email: " <aseem@ascomedical.com>"
Subject	"Remittance Reference Note - TT1802200//MT1036752"
Attachment	"TT (Ref 018006 6743).rar"
MD5	16a6d4f7aedb43d9a9e01e0624ab295f
SHA256	c07018ac47b4918fb64cd1d2ec4727fedcdbb09fa4cdf21f33f16f47da422eaa
Family	SnakeKeylogger

 

(6)

Sender ip	185.222.58.153
From	"Sales<seppo@lopakka.fi>"
Subject	"Re:Re:Re:Re:P/I"
Attachment	"Scan0COPY0002.rar"
MD5	e57ca51e0a429088a5735bd9978aee98
SHA256	97451a8bf2551e89239489a6e8d8dce8cbc3348468d4a0d007894d0cf6c85ca9
Family	Formbook

(7)

Sender ip	188.166.82.8
From	"JUDY WANG" <judy.wang@cono.uk>"
Subject	"1ST SHIPMENTS"
Attachment	"AWB#8001187 SHIPPING DOCUMENTS PL+BL+CI.rar"
MD5	c19c40e19cccffd8c4b3ee4af592ef73
SHA256	01a0491697893c69dec98d83da5a0be3f538e812257db02b5e3e42d41d77afb8
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(8)

Sender ip	45.87.60.140
From	"Yang Ming <sblazquez@asecomex.com>"
Subject	"ARRIVAL NOTICE () BL# M616310389"
Attachment	"Shipping Doc..zip"
MD5	edeca92226d530580e831d3cb7e1d772
SHA256	ae6f8c9c11bba7d0ce66f3560ceb6fa1d9b3ca9dfa9e2973aec4f35ef0c81bbf
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(9)

Sender ip	203.159.80.127
From	“accounts <accounts@integraqatar.com>"
Subject	"Fw: Fw: Fw: RE: ABB USD 2,000,000 -New Puchase Order for our ongoing project"
Attachment	"SKMBT_C36017022513490.pdf (31K).rar"
MD5	3d66e020961260c95adc47de26f5670f
SHA256	77d68d6c2d36c771fcaed62a55fb04d4308d78e08881ed90b77e8ad96168ab1a
Family	NanoCore

If you wanna know how to analysis NanoCore Malware you can check my analysis in YouTube  NanoCore.. 

(10)

Sender ip	203.159.80.127
From	"accounts <accounts@integraqatar.com>"
Subject	"Fw: Fw: Fw: RE: ABB USD 2,000,000 -New Puchase Order for our ongoing project"
Attachment	"SKMBT_C36017022513491.pdf (32K).rar"
MD5	d14499c41a967e2e17d233a551a1dca5
SHA256	22c208411b9e101ad60a0ce3abf50033914423c44f46d608213ba1820632c309
Family	NanoCore

If you wanna know how to analysis NanoCore Malware you can check my analysis in YouTube  NanoCore.. 

(11)

Sender ip	203.159.80.127
From	"accounts <accounts@integraqatar.com>"
Subject	"Fw: Fw: Fw: RE: ABB USD 2,000,000 -New Puchase Order for our ongoing project"
Attachment	"SKMBT_C36017022617081.pdf (30K).rar"
MD5	fb27a7cf9613996237f2320786892994
SHA256	b7e9d7526a6dfddb1ae7247f9c17dcc12627d0b6a44b05e9053ec603b98181c2
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(12)

Sender ip	103.99.1.238
From	"Bridgeway<info@bridgewayshipping.com"
Subject	"Re:SHIPPING DOCUMENT & PACKING LIST"
Attachment	"SHIPPING DOCUMENT & PL.rar"
MD5	75629f37b64200246562aefa1f638ba2
SHA256	7aa20952bc30855f4c2c818105add2bb01eb766502d83a23d832360f7b9a2bfe
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(13)

Sender ip	23.83.133.2
From	"=?utf-8?Q?Shanghai Ming Wah Shipping Co., Ltd?= <exports@haichufanq.com>"
Subject	"INVOICES OF SYNERGY PVT LTD \\ PONU8003969 \\ PONU7863971 "
Attachment	"Shipping Documents-BL#SE20100078001.ace"
MD5	c00d3017f1d0875d83e6900dea7ec38f
SHA256	711881519140b39140030bcb3904064ca9933b1230cbc6ac95ba77a87c58c986
Family	RemcosRAT

(14)

Sender ip	195.201.227.111
From	"De la part de KITCHERAMA TRADING CO. LLC" <amrico@emirates.net.ae>"
Subject	"RE: SHIPPING DOCUMENTS"
Attachment	"Shipping Document.zip"
MD5	534644c1c903e53ac7d986ec7d973234
SHA256	3065a81e114873d9df17b935481954eb0c85edc342e6889b334f51c3f2e15508
Family	SnakeKeylogger

(15)

Sender ip	194.49.78.247
From	"Fayyaz TFM<ops@team-freight.com>"
Subject	"HPE Shipments | HPE_4323_V1 , HPE_4329_V1 & HPE_4005_V1-1 | HAWB No: PSGA00688171"
Attachment	"Email Copy - HAWB No_ PSGA00688171.zip"
MD5	b2f7064c104150491de74bb2cc6c7b36
SHA256	cbc8da9fd827ff80d54955b350c52f26df5a5b6edb103a7d619a7d3cbc07cb44
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(16)

Sender ip	31.210.21.118
From	"renier@groenbou.co.za"
Subject	"Re: Fwd: Quotation"
Attachment	"Quotation 60563.zip"
MD5	f17bd054762467c63819b78405e5ea70
SHA256	fda379289a2cded4c7fb64662da97c551e24f9517672e955354ea4f10906af26
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(17)

Sender ip	45.137.22.71
From	"Sales Dept <info@mirmetal.com.tr>"
Subject	"WIRE TRANSFER 1517796961"
Attachment	"WIRE TRANSFER swift.r11"
MD5	7d58013b652af904e872168bb1ff6105
SHA256	dc19f8218071c91f10dd36cd882c98c9c971757ee2dd9cdbeeaf3a7077bf26a8
Family	unknown

(18)

Sender ip	45.137.22.71
From	"Mostafa <m.mahdi@alangari.com.sa>"
Subject	"Re: Re: PURCHASE ORDER REVISED PRICES// QUOTATION"
Attachment	"REVISED PRICES 20210322 BART56.r00"
MD5	b25c5b061e106240388d4490cb845eb5
SHA256	828be25b5728b443680ea58bd58ec85ff759cc5f798093b3a78c01747ca7dcff
Family	Unknown

(19)

Sender ip	45.137.22.149
From	"ash.zhang@ugslogistics.com"
Subject	"RE: Shipping Documents"
Attachment	"DOC.r15"
MD5	64db8aa6133492a118fc5e079e7d1882
SHA256	5036adaf8f2c82fb66f9c3604ec816f386a0f786a77faaeb35c56d92c6ab8ecb
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(20)

Sender ip	203.159.80.127
From	"T. HALK BANKASI <EKSTRE@halkbank.com.tr>"
Subject	"T.HALK BANKASI A.S.Hesap Ekstresi"
Attachment	"T.HALK BANKASI A.S.Hesap Ekstresi.PDF!.rar"
MD5	3fe0779f1438fb14d04642d9318d07d6
SHA256	895d054412bf0e94dfd32276c9d9eb45e0035c464833fb6d0d3dbb7f3a7aaea5
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(21)

Sender ip	143.110.212.247
From	"Chirag Soni" info@luxadermskincare.us"
Subject	"PAYMENT INVOICE"
Attachment	"INVOICE NO 070FT06.lzh"
MD5	e80504ea47b51f754382274955c7b2c0
SHA256	898801b1f5e565994f6c369264bca1bdfdbb210794448131fb0dc5092bffa0bf
Family	RemcosRAT

(22)

Sender ip	103.145.254.33
From	"Isabelle Bertin <tihi.stojevic@lageros.hr>"
Subject	"PO CF004303"
Attachment	"PO.CF004303.zip"
MD5	15fd83e5fbe925de94d808b56c7f95ea
SHA256	7dd5e15b5f62d3164bfb8e3edb8caf171f9a1c97df8f213ed7920f79221c524a
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(23)

Sender ip	84.38.130.220
From	" Elvin Gementera Cruz" <elvin.cruz@jesco.com.sa>"
Subject	"JESCO RFQ (PR:21001312) URGENT"
Attachment	"JESCO RFQ (PR21001312).rar"
MD5	4b564083a2db7f7a8c30fa226c366e6a
SHA256	0681e69745fd994fa5b22b52069293ec3faa886943e358fbda87dc20b9c3f395
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(24)

Sender ip	45.137.22.149
From	"ash.zhang@ugslogistics.com"
Subject	"RE: Shipping Documents"
Attachment	"DOC.r00"
MD5	1d3f2b322238e732644a63ad57fbbeb2
SHA256	c0937a60690a6c70c39714dba77dc139392f93f7ebc2108856ad326934e38813
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(25)

Sender ip	103.133.106.100
From	"Sabrina Fernandez Maldonado <sales@almerialiving.net>"
Subject	"URGENT PURCHASE ORDER"
Attachment	"Purchase Order.zip"
MD5	b94960997d1fac054f91e03188fa0f12
SHA256	9f7704045124fbd39844bc4a17c34b9d1d8530ef43f48ec91ba9c559f5b454d8
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(26)

Sender ip	185.118.164.92
From	"Mattia Cuman " <mattia.cuman@medelinternational.com>"
Subject	"MEDEL PI"
Attachment	"MEDEL09435#INVDIAGNOEQUIP.pdf.zip"
MD5	20db81da1471ee3550b45d32bfc450d6
SHA256	16666f1d4d623a9b3ee23b2f6ac3f85441c81e9be17d028530081b6a3991e47a
Family	SnakeKeylogger

(27)

Sender ip	194.49.78.247
From	"Fayyaz TFM<ops@team-freight.com>"
Subject	"Shipments | HPE_4329_V1 & HPE_4005_V1-1 | HAWB No: PSGA00688171"
Attachment	"Email Copy - HAWB No_ PSGA00688171.zip"
MD5	328946c937e153aa85a5d48754b7009d
SHA256	6bff25a8218e1ef959dae91897a7315cc42e96365b24064dbbfc9cb90f7c7e26
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(28)

Sender ip	103.139.44.91
From	"SAILUN GROUP <boris.zhang@sailuntire.com>"
Subject	"ADVANCE PAYMENT/SWIFT COPY"
Attachment	"PI-ADVANCE PAYMENT.rar"
MD5	d1c7ad2c5c731b27eb2b43cebb91eca2
SHA256	1cc002ccb2341e5d8cb430fed427636cdf777b66a40d55f96e92726463cf9bbf
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(29)

Sender ip	103.139.44.91
From	"SAILUN GROUP <boris.zhang@sailuntire.com>"
Subject	"ADVANCE PAYMENT/SWIFT COPY"
Attachment	"SWIFT COPY.rar"
MD5	3239f13e4c32a28b4894acfb5a26863a
SHA256	b69b5ba40c54631b0c63ad14f201f9fc3227a57a1edfc4b8d06abce886ac22c8
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(30)

Sender ip	103.133.106.100
From	"Thai Taj <tajgroup@vsnl.com>"
Subject	"Shipping Documents"
Attachment	"Shipping Docs_222738.zip"
MD5	70622a9d433cf1222ec0f1cfbd105e17
SHA256	ca7d5eab5da4fcebcd14c42582e61abc32a055ca65780fe83e4866b5c96b12f1
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(31)

Sender ip	103.133.106.100
From	"Thai Taj <tajgroup@vsnl.com>"
Subject	"Shipping Documents"
Attachment	"BL.zip"
MD5	5e9fc3e8e46469128e283901ece8bfa7
SHA256	84958ad9a7dac74ce2acd2474c8202e1d872e4b4a1bf73d5411e35293f177d17
Family	SnakeKeylogger

(32)

Sender ip	31.210.21.118
From	"stefanie@globally.ae"
Subject	"Re: Quotation 60584"
Attachment	"Quotation 60584.zip"
MD5	7ebc4f805ddf9e73b25985141a9e0c24
SHA256	9bd574f642942674fbd1dc228521251d23f9c02e0db08ba1346c58a0c48664df
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(33)

Sender ip	103.153.182.81
From	"=?UTF-8?B?Q2VjaWxpYSBMw7Z2YmVyZw==?=<cecilia.lovberg@geodis.com>"
Subject	"FW: UP TO DATE S.O.A & INVOICE"
Attachment	"S.O.A.PDF.z"
MD5	e52d22c2b72b142035d013bb94a624db
SHA256	acde2ab860a161351f765b324bdbda9cc4a897c1b78cfa74befa785ad2f68ba3
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(34)

Sender ip	103.153.182.81
From	"=?UTF-8?B?Q2VjaWxpYSBMw7Z2YmVyZw==?=<cecilia.lovberg@geodis.com>"
Subject	"FW: UP TO DATE S.O.A & INVOICE"
Attachment	"INV_04905.PDF.z"
MD5	838eb9294a4beec44ecfbe16a19deaf9
SHA256	d2d7ea944ecc759531c1e19f113536b07041e309d9b7484d378f991b392983de
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(35)

Sender ip	185.222.57.229
From	"cn.international@ksh.biglobe.ne.jp"
Subject	"RE: Revise PI"
Attachment	"invoice.zip"
MD5	bd53fbfd9142ea4fa418e8b94718c678
SHA256	24b9f122349006afe996eb49534f12789789e56b5ebea1c4cae476ee13c0ce25
Family	Formbook

(36)

Sender ip	103.133.106.100
From	"Thai Taj <tajgroup@vsnl.com>"
Subject	"Shipping Documents"
Attachment	"Shipping Docs_222738.zip"
MD5	70622a9d433cf1222ec0f1cfbd105e17
SHA256	ca7d5eab5da4fcebcd14c42582e61abc32a055ca65780fe83e4866b5c96b12f1
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(37)

Sender ip	103.133.106.100
From	"Thai Taj <tajgroup@vsnl.com>"
Subject	"Shipping Documents"
Attachment	"BL.zip"
MD5	5e9fc3e8e46469128e283901ece8bfa7
SHA256	84958ad9a7dac74ce2acd2474c8202e1d872e4b4a1bf73d5411e35293f177d17
Family	SnakeKeylogger

(38)

Sender ip	31.210.21.118
From	"stefanie@globally.ae"
Subject	"Quotation 60584.zip"
Attachment	"BL.zip"
MD5	7ebc4f805ddf9e73b25985141a9e0c24
SHA256	9bd574f642942674fbd1dc228521251d23f9c02e0db08ba1346c58a0c48664df
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(39)

Sender ip	103.153.182.81
From	"=?UTF-8?B?Q2VjaWxpYSBMw7Z2YmVyZw==?=<cecilia.lovberg@geodis.com>"
Subject	"FW: UP TO DATE S.O.A & INVOICE"
Attachment	"S.O.A.PDF.z"
MD5	e52d22c2b72b142035d013bb94a624db
SHA256	acde2ab860a161351f765b324bdbda9cc4a897c1b78cfa74befa785ad2f68ba3
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(40)

Sender ip	103.153.182.81
From	"=?UTF-8?B?Q2VjaWxpYSBMw7Z2YmVyZw==?=<cecilia.lovberg@geodis.com>"
Subject	"FW: UP TO DATE S.O.A & INVOICE"
Attachment	"INV_04905.PDF.z"
MD5	838eb9294a4beec44ecfbe16a19deaf9
SHA256	d2d7ea944ecc759531c1e19f113536b07041e309d9b7484d378f991b392983de
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(41)

Sender ip	185.222.57.229
From	"cn.international@ksh.biglobe.ne.jp"
Subject	"RE: Revise PI"
Attachment	"invoice.zip"
MD5	bd53fbfd9142ea4fa418e8b94718c678
SHA256	24b9f122349006afe996eb49534f12789789e56b5ebea1c4cae476ee13c0ce25
Family	Formbook

(42)

Sender ip	31.210.21.165
From	"Yosmarta Kahar <c.santos@epic-pharma.com>"
Subject	"Re: Re: Re: Sign PI (PO. 2100002 (BT-INC)-PAYMENTS "
Attachment	"PO1234EFJL_011LM000_pdf.gz"
MD5	e89edc057caca569d778e8837096f4e6
SHA256	6dc206b5eb1c52c0dbaee39ee5a79e03caf69bc82ac8bbccbdcd41f4711fc13f
Family	Formbook

(43)

Sender ip	203.159.80.127
From	"RAJEEV <catetreding@gmail.com>"
Subject	"Invitation / PQ Documents Submission"
Attachment	"Invitation for potential projects Specification.PDF!.zip"
MD5	096097aef86ab914dc7a582db93d6b84
SHA256	2122b12c1f10d2b0dcd824612939b67d7a24a08c9e929eac08ba71430afe4fb0
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(44)

Sender ip	203.159.80.127
From	"RAJEEV <catetreding@gmail.com>"
Subject	"Invitation / PQ Documents Submission"
Attachment	"Invitation PQ Documents Submission.PDF!.cab"
MD5	d81f0c52416539a5ca6c5ae74b8450c6
SHA256	0e935a97c2ba17add2d1bece5d42ab590d65af004852c0c6d5a29a9d859e569d
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(45)

Sender ip	203.159.80.127
From	"RAJEEV <catetreding@gmail.com>"
Subject	"Invitation / PQ Documents Submission"
Attachment	"Invitation PQ Documents Submission.PDF!.cab"
MD5	d81f0c52416539a5ca6c5ae74b8450c6
SHA256	0e935a97c2ba17add2d1bece5d42ab590d65af004852c0c6d5a29a9d859e569d
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(46)

Sender ip	103.133.106.100
From	"Ajaree Sricharoen <info@kdm.co.th>"
Subject	"Revised order for 40ft container"
Attachment	"Scan 20210519.zip"
MD5	ef1b96301358b5671a48d5a7f419f7ee
SHA256	b0363b733a3bbeaa855b76adb25239bf2d96e49a6453c687e1a2776d1b818b1a
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(47)

Sender ip	31.210.20.71
From	"OPS/ROYAL PACIFIC SHIPS"<ops@royalpacificship.com>"
Subject	"///RESENDING///AGENCY NORMINATION-MV OLYMPIC PROGRESS"
Attachment	"MV OLYMPIC VSL PARTICULARS & MASTERS INSTRUCTIONS.zip"
MD5	ee26d5d717f9e9b535504ff9989d890e
SHA256	cbc87d70317d1e6ae7b31e7b04aaf4d4f3657fa547366b39bc8553d8e25544a6
Family	NanoCore

If you wanna know how to analysis NanoCore Malware you can check my analysis in YouTube  NanoCore.. 

(48)

Sender ip	103.153.182.81
From	"Gracinda Costa <gracinda.costa@conceito.pt>"
Subject	"Re: INVOICE Export B/L # DSA6694/6929RTM"
Attachment	"INVOICE-1322.PDF.z"
MD5	f147242203f1471d0f7265faad01fba6
SHA256	b804e7c3a6a9244d379f981ad8eef4a5ebcf2f36b91a44a6ce190e08a0c34fb5
Family	Formbook

(49)

Sender ip	45.137.22.56
From	"FINANCE <RobbieCheng@pageonegroup.com>"
Subject	"Fwd: Revised Invoice-Order"
Attachment	"paid invoice.pdf.7z"
MD5	c2b8d37fe3a6feda5daacd99652528e7
SHA256	c65d421876d3fec1bdbe5ee13415d8304249b2a41cc265b37053ca6210bfb02a
Family	NanoCore

If you wanna know how to analysis NanoCore Malware you can check my analysis in YouTube  NanoCore.. 

(50)

Sender ip	45.35.196.140
From	"administrator <c.a.manivanna@accenture.com>"
Subject	"RE:URGENT PO# 8956897020 TOS-00974"
Attachment	"PDF#Purchase order22435.ace"
MD5	7f0f0a874b085b4f16dfcd2e2a7389af
SHA256	119530df722e9f97ed26fc3238dce5b90b2e2dba1669e827cdeff298554b3c11
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(51)

Sender ip	45.137.22.71
From	"Cus - Max Service <cus@maxservice.com.vn>"
Subject	"RE: DRAFT BILL #040BA05287 /01X40RH KOBE*ETD 22 MAY"
Attachment	"WDMFT505_BL_VNHPH01_NTTQUYNH_0520_000018_040BA05287-MAIL.PDF.r00"
MD5	a902787faca146cd34cd08e2159f192d
SHA256	0761d1ae319f9d37dd09aa0498e978f1dd76ead29c2e4762f288483339928492
Family	SnakeKeylogger

(52)

Sender ip	45.137.22.71
From	"Mostafa <m.mahdi@alangari.com.sa>"
Subject	"Re: Re: PURCHASE ORDER REVISED PRICES// QUOTATION"
Attachment	"PURCHASE ORDER REVISED PRICES QUOTATION.r11"
MD5	9bdece8efc88ea5dcac2f42dd24a8b06
SHA256	d048ba09e96f636448057ef83d88961c9868ffbd16ae592d37538bb548c053cd
Family	SnakeKeylogger

(53)

Sender ip	185.222.57.229
From	"cn.international@ksh.biglobe.ne.jp"
Subject	"RE: Revise PI"
Attachment	"invoice.zip"
MD5	004dd694f287411063bfbfd83d528916
SHA256	c5425b8f9762f3acf7d1accd773336c78c4daf5b1fbde2f160787c584c5a5e53
Family	Formbook

(54)

Sender ip	45.35.196.140
From	"FedEx Express<info@znshenesolar.com>"
Subject	"FedEx Express AWB#5305323204643 - Information is required"
Attachment	"AWB#5305323204643.zip"
MD5	e9676de2c97e46b2a85fe7be139844dd
SHA256	f3b1ff9442ab40d22a06806061dd99b370f6ab87c5aeceefc46c340834024319
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(55)

Sender ip	45.35.196.140
From	"FedEx Express<info@znshenesolar.com>"
Subject	"FedEx Express AWB#5305323204643 - Information is required"
Attachment	"FedEx Express-Reciept.rar"
MD5	f684a1ae652577db0d415c6fc3e7cfb3
SHA256	2ce5a9f8be3febcaec5cd8354e4ba701508ee579654a770ea56244b0e810973d
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(56)

Sender ip	45.87.60.140
From	"Lee Acct. <infocordoba@familiafalasco.com>"
Subject	"TT copy 130,839.00USD"
Attachment	"Scan 130,839USD.7z"
MD5	c31404ab6bdf8b90dea181560c1c90b5
SHA256	76489e8adf7e046f7cc7513ffc79760e313ad3e71ccc63e361173a410f5d1444
Family	SnakeKeylogger

(57)

Sender ip	138.68.8.255
From	"=?UTF-8?B?ICJLVCBJbnRlcm5hdGlvbmFsIC5MVEQuxZ5UxLAi?=<info@xv4w.xyz>"
Subject	"AW: Re: Order Confirmation Requirement"
Attachment	"PO New Order.zip"
MD5	581ccff9a4dd485ac37399b5b563d4df
SHA256	afb6ac1bd79aef042c365616dc6f0803ca0038012a3778dec42f511447c3a6d3
Family	Loki

(58)

Sender ip	31.210.21.118
From	"Sibi.raj@qi-energy.ae"
Subject	"RE: Request for Quotation"
Attachment	"AMDPI 2021.zip"
MD5	11c1a927ae0513ca1b9a8b8fabd9061b
SHA256	54906dba547718d64dedcbb96b4148b49967f584c4930f5759fbb5fabab9d1bf
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(59)

Sender ip	185.121.120.135
From	"Wang Wei <sales@besmed.com>"
Subject	"Aviso de pago - Ref. Aviso[G1117599144] / Pago prioritario"
Attachment	"BANK DETAILS ...gz...pdf"
MD5	6ea34a19ff521aff47416f8ab4311963
SHA256	2a14b1082d6e0b2fd03325cd2f91b2704b05bfeda55618526301012a08221fb8
Family	SnakeKeylogger

(60)

Sender ip	45.137.22.101
From	"pamel_21_02@hotmail.com"
Subject	"=?UTF-8?B?5Y+R56WoXzg5MzQ1NA==?="
Attachment	"09090000000000090.PDF.z"
MD5	dc76dc7df54b1f4a5fcc3abea0d5f1fa
SHA256	0f0a22cdf88b8767785f6113b920b9df1375559eb4c95a015221ad3d0a4a118c
Family	Unknown

(61)

Sender ip	136.243.232.251
From	"Director enforcementenquiry <enforcementenquiry@alibaba-inc.com>"
Subject	"Contract 27/5/2021 for Invoice Packing list and FIL"
Attachment	"Invo and Pack list.gz"
MD5	b7098dd3eca5af4204ef02a079c94725
SHA256	eed1f454d5dd1e4b0a61e425d787d439bb69d789c2fa7072d06a9d6cadadb0a3
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(62)

Sender ip	193.169.255.128
From	"KRRINT INTERNATIONAL<enquiry@krrinternational.com>"
Subject	"RE:QUOTATION"
Attachment	"RFQ MLK #656577.arj"
MD5	63b3e654d0a4baabb43fc1567118dbed
SHA256	88e3a8474ce8258d93467774ad82fb237d2c88e9ca091dfa90e57af1e2ccbf23
Family	Unknown

(63)

Sender ip	45.137.22.101
From	"pamel_21_02@hotmail.com"
Subject	"=?UTF-8?B?55m856WoXzg5MzQ1NA==?="
Attachment	"4090800.pdf.lzh"
MD5	2f460b94a9e53fb676aa84a66ff51424
SHA256	91dfd17bf11e35a714076e1e4e403d0a95573a9e1bfb7485d249085be890f62a
Family	QuasarRAT

(64)

Sender ip	45.87.60.140
From	"Dainel He. <davidhe@nbpif.com>"
Subject	"Purchase Order (P.O.) No.4036041334"
Attachment	"New Purchase Order.zip"
MD5	7a66a97b1c85e4e0a3b41afcab017004
SHA256	39927ae61506aa5843d1c0a3c59326056718824ea64eaf0399c04c3f431cf7e6
Family	SnakeKeylogger

(65)

Sender ip	167.172.100.93
From	"=?UTF-8?B?w5ZtZXIgw5ZaVMOcUks=?=" <omer.ozturk@martellettina.xyz>"
Subject	"SHIPMENTS FOR INV FNT022202101 FNT054402101 FNT023302101 FNT024202101 FNT089202101"
Attachment	"SHIPMENTS FOR INV FNT022202101 FNT054402101 FNT023302101 FNT024202101 FNT089202101.rar"
MD5	19564405739674482473e0f0c89441cc
SHA256	c6aa20cfb1e01e267566a1b47ef22befcda83e4cfce36b856bc6366407fb3a49
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(66)

Sender ip	103.139.44.91
From	"Jair Saavedra"<Jair.Saavedra@us.bitron-ind.com>"
Subject	"RE: [URGENT!] Payment Confirmation Copy - Kindly Release Our Order"
Attachment	"Blanket order 20210423001.tar.001"
MD5	370ab95039316d69cdaefc0271d4f041
SHA256	37bdae78da40f9492cf5d6d4271d688c1a8f2701cd087264a702a847170568b8
Family	AgentTesla

If you wanna learn malware analysis you can check my YouTube channel I'm trying publish analysis of malware and some methods to analysis malwares.
Please don't forgot subscribe my channel Than you ♥  

YouTube channel 
https://www.youtube.com/channel/UCParXHaBXBmqRdHuVUg21pA