Phishing Attacks 7_5_2021

 

(1)

Sender ip	103.139.44.91
From	"SAM CHEN <dbeery@3oaksretreat.com>"
Subject	"NEW ORDER #776483 "
Attachment	"NEW ORDER #776483 - Copy.rar"
MD5	4d7fd81ab316988becd9d10e520ced98
SHA256	7e124e2b43350542e69a9a40e9c2f66ec43b54e155e54744b3c1f8ae0a87e6ad
Family	AgentTesla

 

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(2)

Sender ip	31.210.21.71
From	"Filiga Lauama | Finance Dept" <filiga@npf.ws>"
Subject	"RE: Re: PAYMENT ADVICE"
Attachment	"Payment Advice.ace"
MD5	9734315e8f21a21af680fa517d56deb0
SHA256	d8a3f997814712c60b6db89d30b8b9faf71be66a95afdb7c48685ff2124728bc
Family	OskiStealer

 

(3)

 

Sender ip	185.121.120.125
From	"Banca March <G0275@bancamarch.es>"
Subject	"ABONO FACTURAS-CONFIRMING BANCA MARCH"
Attachment	"Documento.xlsx"
MD5	f978cac45dfd04ded9c301c492d45c69
SHA256	372a5b41afc06f25c0c2a27b4bb1a362f4fb9772deb9ad996a7dfe4ad7bd96e3
Family	unknown

 

(4)

 

Sender ip	199.10.31.238
From	"Olavi Autio <OlaviAutio@teleworm.com>"
Subject	"AW : New Business Opportunity"
Attachment	"New Order Requirement 2204.ace"
MD5	2b3ec0cd498878fd0e5de24a9a7d428a
SHA256	a2442bb8a9aeb8af98ccfb07ad9afd62bdbedeb942971a8644d63687dbb65490
Family	OskiStealer

 

(5)

Sender ip	103.133.106.100
From	"Sofien Ben JEMAA <info@4sps.in>"
Subject	"CHM invoice"
Attachment	"Scan 20210507_178854.zip"
MD5	6328e4ce2a827c2026aaaefbba470e9b
SHA256	cdc6f7d17ba04cf4b1f66126c1d8b7bb14cf6e7cf0d600fdfb92904262cd2fb5
Family	AgentTesla

 If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(6)

Sender ip	103.133.106.100
From	"Iris Chen <chenqihui@shpni.com.cn>"
Subject	"Submission of Commission Invoice"
Attachment	"Commission Invoice.zip"
MD5	b7f346e08a59ff0612b9c42713b984bd
SHA256	4a46677d63fcd885bac9a1fd3aefc41a856dc527af989f116faf9c7435218e44
Family	SnakeKeylogger

(7)

Sender ip	45.137.22.149
From	"info@dijlashipping.com"
Subject	"RE: SHIPPING DOCUMENT & PACKING LIST"
Attachment	"PMSHIPPING DOCUMENT & PL.r00"
MD5	8f1d3b0ef919775f563e4c6fe4cc2f91
SHA256	3f21c1dadbb99df098bc46b886abcd6d8e9d4093e9283f6bf9de185a2446dddf
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(8)

Sender ip	185.222.57.162
From	"Van Ryn Rubber Holdings<vijayj@vanrynrubber.co.za>"
Subject	"RE: PRICE LIST OF OUR OFFER"
Attachment	"PRICE LIST.zip"
MD5	86d2c7008eb5dad31b77ed619b2c7e7b
SHA256	592f466fc7eed27d377915a732e30c9582cdc6d456bf58d87a1161fbbc494c7c
Family	AgentTesla

(9)

Sender ip	165.227.140.187
From	"<customerservicehls@mairon.de>"
Subject	"DDP shipment /// MAWB # 607-20263025/HLSB01463 & HL260337100 | Consignee:lgpartner.ch "
Attachment	"260337100 HBL.zip"
MD5	688fcf858494815d70acd0ecf3f01a28
SHA256	2e5457602d420ce29d96c2b95b566976c2315b4bd73db3a18264c177d4bab60a
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(10)

Sender ip	185.222.57.229
From	"sales@covein.com"
Subject	"RE: Confirm revised invoice to proceed with payment ASAP"
Attachment	"proforma invoice.zip"
MD5	f770038b37702193a086d66371832fbd
SHA256	6be43ab36faddafa332267ee763dd5b58fbe5e23d1a3a14e61f07c29c04647b1
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(11)

Sender ip	45.143.147.194
From	"=?UTF-8?B?Q2hyaXMgU2NoaXJtZXLCoA==?=<salez@ettinger.de>"
Subject	"RE:RFQ 11054 - REQUEST FOR QUOTATION"
Attachment	"RFQ 11054.pdf.zip"
MD5	67bfe027b60278a7c538e3cc5a7b5ab2
SHA256	48f60cae51e51d9eb76e65c8afacb3248ab8d6227d15028ebc9ab00a58b2d4fa
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(12)

Sender ip	103.133.106.100
From	"Tarek ABIDA <info@probona.com.tr>"
Subject	"Official VAT Bulletin"
Attachment	"VAT Bulletin.zip"
MD5	a6475073b162f05363ba4fd3d55dfa7b
SHA256	d2e6de2957b1309319e05496d6d0c4d9735150f86d0336a17dd6e2c07b127c02
Family	SnakeKeylogger

(13)

Sender ip	45.137.22.149
From	"gicdelhi@general-gauges.com"
Subject	"RE: PAYMENT INSTRUCTIONS"
Attachment	"PAYMENT INSTRUCTIONS COPY.r00"
MD5	e158955e61b2f8d5d5534d55d255a52b
SHA256	fc3048b49f76549b9af326740510bca78205dd37b26f10378f5028f7db692485
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(14)

Sender ip	185.121.120.135
From	"Wang Wei <sales@besmed.com>
Subject	"RE: QUOTE NEW ORDER- SCAN & SOFT COPY/ CDRL W-18 BAL QTY-560 PCS##"
Attachment	"FW RE TEXGEEK INVOICE & PACKING LIST - SCAN & SOFT COPY.PDF.gz"
MD5	0b0c8900ce047f05c23052cd7ee3f80c
SHA256	e4f77717914eac20b42ac6886aa29d8ea14eb89829f9e8b6c9d4277a125f603e
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(15)

Sender ip	45.137.22.36
From	"<ahmed@hicinfrastructure.com>"
Subject	"Re: FW: Invoice"
Attachment	"image002.png@01D4EB98.FAE33E60.rar"
MD5	845e5449b1cbcda129921bc273b38955
SHA256	41e349119b9a1aebc063485f05b1110c7f4f6524560dff0dd7f2b832b544261b
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(16)

Sender ip	193.169.255.128
From	"Krrint Tradings LTD.<enquiry@krrinternational.com>"
Subject	"Urgent Inquiry!"
Attachment	"oder mcdq.arj"
MD5	3ab2ef437054eab9c57e9b8bfb02f2d4
SHA256	85676ce2ff8483e0e6167360c33caf0e023e5d51d236eec49f35a5159787ed4d
Family	AveMariaRAT

(17)

Sender ip	103.139.44.91
From	"info@guxiandao.com"
Subject	"RFQ NEW PART FOR ED53224 (ETB _ PRO 2110 XP CNG )"
Attachment	"drawing of ED53224-pdf.gz"
MD5	2762a569b3d682b1933d7468a0aab14d
SHA256	dd45ca037db58414d7242293cbf0f3a6ff6cf31a03a364e6e322d85691092f63
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(18)

Sender ip	103.139.44.91
From	"info@grupoian.com"
Subject	"RFQ NEW PART FOR ED53224 (ETB _ PRO 2110 XP CNG )"
Attachment	"drawing of Part No R5-892-pdf.gz"
MD5	6fc21917bcfe0f7fd9a6174f6cbd858e
SHA256	1b1d4d5e5d506d26803bfdfb9789b04d6b071bd8b8576e8351d2705b7c585619
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(19)

Sender ip	185.121.120.135
From	"Gerente de carga de DHL <pagos.fletes@dhl.com>"
Subject	"Nueva =?UTF-8?Q?notificaci=C3=B3n=20de=20env=C3=ADo=20de=20DHL=23?="
Attachment	"numero de referencia de los documentos de envio..gz....pdf"
MD5	ce47b6121ac5b0bdfee736a9981540df
SHA256	133cf5e1936834372a85e49df50d3246283100b13bb2f1f695ea77333756d960
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(20)

Sender ip	185.121.120.159
From	""Omar Baddar" <postmaster@allstew.com>"
Subject	"RFQ-50236710-ETECSA"
Attachment	"IMG_6050_710_33.R03"
MD5	341f36724c7fd6d7fcf4b00bba88a56b
SHA256	ad4c6d70e83b368d4f060ade367c82584e002b80e6ec80e272d7da1300e3f91a
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(21)

Sender ip	31.210.20.242
From	"Veli <veli@reelsektor.com.tr>"
Subject	"RE: Proforma ve packing list "
Attachment	"Proforma+Packing list.r00"
MD5	8d0a647e7bcccf36b16840403183b95d
SHA256	6460588f6af7ee7a18cd7acd5c4cb451d9512aa4a14f8d09ee90da44bc82b5a9
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

(22)

Sender ip	45.143.147.194
From	"=?UTF-8?B?Q2hyaXMgU2NoaXJtZXLCoA==?=<salez@ettinger.de>"
Subject	"RE:RFQ 11054 - REQUEST FOR QUOTATION"
Attachment	"RFQ11054.pdf.rar"
MD5	e919b8869c063b9efd15de5d9e50c200
SHA256	eee3a79bdced476a47f4feda2dd96b587cdcaf3aa2394f3af5269ca1b01d40bf
Family	AgentTesla

If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla

If you wanna learn malware analysis you can check my YouTube channel I'm trying publish analysis of malware and some methods to analysis malwares.
Please don't forgot subscribe my channel Than you ♥  

YouTube channel 
https://www.youtube.com/channel/UCParXHaBXBmqRdHuVUg21pA