Phishing Attacks 23_7_2021

 


If you wanna learn how to detect phishing emails  only by your eye , you can check my udemy course here 👇.

My udemy course

(1)

Sender ip

185.222.57.75

From

"Executive Operations <pradeep@linexsolutions.com>"

Subject

"RE: Re AW: 45949 - Confirmation Order 3886636 Open file."

Attachment

"PURCHASE ORDER-890003.r00"

MD5

7d3a9e753d73e64f6593babb4a50f749

SHA256

72ae99647b3d5a4ea568cf9091544ca96bbab701e5e275e88b37eef3b98f51ce

Family

AgentTesla

   If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.


(2)

Sender ip

103.139.44.91

From

"info@siatigroup.com"

Subject

"Payment Proof for PO-MPU702734"

Attachment

"MPU702734-pdf.gz"

MD5

8cc223e6cc55de1d025e392e7010cc67

SHA256

4f35c50ec3a7099c8058d999c4c8756f0230dc9c68760b61156586031fe52db3

Family

Unknown

 

(3)

 

Sender ip

103.139.44.91

From

"import@fridja.com"

Subject

"RFQ PO-391SXF- URGENT "

Attachment

"391SXF-pdf.gz"

MD5

4b9bca84a76b99a378984a901448e5aa

SHA256

f3d652a1de146b29816ecbd82b3e3f012244c350f245f52bb0954ece786ad4dc

Family

Unknown

 


(4)

 

Sender ip

91.222.7.1

From

"Dennis TradeGlobal <Dennis_Tradeglobal@protonmail.com>"

Subject

"Fwd: Order Inquiry"

Attachment

"Order_Sample.png.img"

MD5

04a77f3faec48eef1fab1f90d0c13ce9

SHA256

6bdd8c9323dfe3f3ce5d5c438f5062b22038e4642b6990125e06f9189d382e00

Family

Unknown

 

(5)

Sender ip

103.114.106.156

From

"overseas@haewon.net"

Subject

"Euro Payment Only//Revise Invoice to Euro Currency//Provide Euro Bank Details"

Attachment

"Inv_7623980.r15"

MD5

fc6affa7cd16c60dc547d3417142dbe4

SHA256

74895afae683396981f97ac9816f39ea4f0c0588355ea6e7696034aa1650d6f8

Family

Unknown

 

(6)

Sender ip

185.222.57.72

From

"ANZ Kiribati <TransactiveAPEA.CGI@anz.com>"

Subject

"RE:TT Payment advice P44898408970-1 from Australia and "

Attachment

"P44898408970-1.zip"

MD5

0aa67c12db0e3ea16a183f2625b0b31d

SHA256

4a919c78e17213d98f10f49a921bf41164e6206e63bc3cbe487092b078189a0a

Family

Unknown


(7)

Sender ip

185.222.57.72

From

"David Ng <customercare@omfreight.com.cn>"

Subject

"RECONFIRM BANK DETAILS FOR PAYMENT"

Attachment

"BANK DETAILS.zip"

MD5

d96806deb211163cce64cb6d8bfe76e1

SHA256

fe9a3933128b2954090c969682e654f1349ed093f45d4bd2e8546beff5497654

Family

Unknown


(8)

Sender ip

185.222.57.72

From

"Mohammad Rashedul Alam<rashed@sumaco.ae>"

Subject

"Request to URGENT REQUIREMENT! ( Ref : 10M-86776)"

Attachment

"Ref 10M-86776.zip"

MD5

569c5034055681e0b6fe61e6aed888d0

SHA256

8ed5b07f6059f515eb428156e40bf1e192ec7cfde40fa64d0938b7edea8fd3e9

Family

Unknown


(9)

Sender ip

103.139.45.212

From

"Irene Chan<irene.chan@transcargo.com.my>"

Subject

"Payment Invoice"

Attachment

"Payment_invoice.zip"

MD5

d3564945f7bca84c662520b8417d3b39

SHA256

a6bd7955c36addf2593f1fd2ec04ea6557db2e1e2af523ca750f5923116994c0

Family

Unknown


(10)

Sender ip

45.137.22.75

From

"Ravi jaitly"<ravijaitly@dcmshriram.com>"

Subject

"Purchase Order 4110043899"

Attachment

"Released Order.r15"

MD5

6c8eba98915a064fcad85ae98528877e

SHA256

6dab315ebf0f7fee41c9a2377512f4d2a98b0e1c27cc6980324c0820fcf163df

Family

Unknown


(11)

Sender ip

172.93.164.220

From

"Tana Medic <sales@gki.com>"

Subject

"Items Description for Quote"

Attachment

"DOC98374933_JULY2021.iso"

MD5

c6c39101ee5c94dff00cd940617d0294

SHA256

9bafab21d172a1a4c7cc88eb44ca8292a8f96f812d7b4c71b706479f22690b7a

Family

OskiStealer


(12)

Sender ip

172.93.164.220

From

"Tana Medic <sales@gki.com>"

Subject

"Items Description for Quote"

Attachment

"DOC98374933_JULY2021.iso"

MD5

c6c39101ee5c94dff00cd940617d0294

SHA256

9bafab21d172a1a4c7cc88eb44ca8292a8f96f812d7b4c71b706479f22690b7a

Family

OskiStealer


(13)

Sender ip

185.222.57.75

From

"Export Manager <joshua.yu@titanos.com.cn>"

Subject

"RE: Re Forwarded Payment slip Confirmation attached bill No. 2652-21-22O open attach file."

Attachment

"Payment slip.r00"

MD5

b5b2779d4fbbac3dcfbd03397782e528

SHA256

ddade50a00b5a1e9b4c41b2d8f79be151b55e52a240378e2e2a10f4fca67d03f

Family

AgentTesla

  If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(14)

Sender ip

40.107.67.64

From

"Gagnon-Rolland, Marianne" <gagnon-rolland.marianne@courrier.uqam.ca>"

Subject

"=?iso-8859-1?Q?TR_:_R=E9clamation_de_Gain?="

Attachment

"Remise.docx"

MD5

bf6840f282a788c22d47afa80c9f850a

SHA256

e03772203fb29e8893bf4e0664c4bdd16b36177ee694cf9047e5d8251edeec40

Family

Unknown



(15)

Sender ip

103.139.44.91

From

"info@siatigroup.com"

Subject

"payment advice 10-06-21"

Attachment

"Swift-pdf.gz"

MD5

af9bb5934be920668eb417cdb72f7148

SHA256

5c12f69c9907c35269bc9893b25c5440583167d7384d838c285bd97b8726337b

Family

AgentTesla

  If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(16)

Sender ip

185.222.58.104

From

"Azarudeen<swapnil.m@rhsfreightkenya.com>"

Subject

"CARGO ARRIVAL NOTICE-MEDICOM AWB:098-88679080"

Attachment

"CARGO ARRIVAL.lzh"

MD5

ded00ce5f2d97d2c052322e83c814d20

SHA256

a0c5b8f728ee17e96b5e49b9ba5de873331dda3f5751efc0665d22b3491c6139

Family

Unknown


(17)

Sender ip

45.137.22.75

From

"aziz@technomechengg.com"

Subject

"RE: Payment Advice for SN 951606"

Attachment

"HSBc20210216B1.r15"

MD5

e4a4399e36ec35372d36c2c3fc3b9da3

SHA256

00738e5877d85de04dce218a652c689db6ce03926ed4d27efaa2b9f2670e8739

Family

AgentTesla

  If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(18)

Sender ip

185.222.57.75

From

"Export Manager <joshua.yu@titanos.com.cn>"

Subject

"RE: Re: Re: AW: Ref No.46116- Qoutation Inquiry download file."

Attachment

"Purchase Order-46116.r00"

MD5

6dee8a69c588a2cb06e4e844ee92f3b3

SHA256

29eefeb71cbe62702ee8a28df21a8cff6a030a14f92583d9e1f3cd57600e316c

Family

AgentTesla

  If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(19)

Sender ip

203.124.11.93

From

"Julius G. Ramas <amywang@tatming.com>"

Subject

"QUOTATION REQUIRED"

Attachment

"QUOTATION.tar.gz"

MD5

0343a4901e5c4cf535dedc473010a80f

SHA256

9fff4cf47a6bc7a063864d90715f6edcb12ef9582106ab0e0dbf7e84cbae3b59

Family

AgentTesla

  If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(20)

Sender ip

185.222.57.72

From

"Mohammad Rashedul Alam<rashed@sumaco.ae>"

Subject

"Request to URGENT REQUIREMENT! ( Ref : 10M-86776)"

Attachment

: "Ref 10M-86776.zip"

MD5

c223ea5319157c107c0f59f8120af147

SHA256

d5aaa5af1ffb58a3e7ac83653521b6d3d0f5dfb9f3be3b1b324482906c6e1346

Family

AgentTesla

  If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(21)

Sender ip

185.222.57.72

From

"Caterina Rebora <Caterina.Rebora@melia.com>"

Subject

"RE:Commission Payment Form "

Attachment

"Payment Form.zip"

MD5

b95574f0b21fb85e7d2dd96a0a026594

SHA256

c01f41a2f928c4e3b9bc4130e059095d87994146625fc71708c7bc85f5dae09a

Family

AgentTesla

  If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(22)

Sender ip

45.137.22.38

From

"Rayeez Raja" <rayeez@atc.com.kw>"

Subject

"Second Invoice Overdue Notice"

Attachment

"Second Invoice Overdue Notice.wim.tar"

MD5

14169794d8615087d914881bb421566d

SHA256

d2ef9477fd0faf7f5cbf4cba2c39301cf3b3081b4f392083d21eac2555377f1c

Family

SnakeKeylogger


(23)

Sender ip

37.0.11.194

From

"jessica<Armstron@nomatek.fo>"

Subject

"Deposit slip."

Attachment

"Deposit slip.arj"

MD5

6d58e3e81fb649bc2590291075f4527b

SHA256

35b7180a93ebdc908cd25c04511e9761497d046422dbb3b5f1cd0627c0fc9b47

Family

AgentTesla

  If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(24)

Sender ip

195.58.39.197

From

"Svetlana Hristenko"<fayeconquest@gmail.com>"

Subject

"Re: ORDER."

Attachment

"ORDER407-395.ace"

MD5

c002fb890ed879bfc9919b22f50bf764

SHA256

aa649c83ac0eda6cf32e4baaa8e8cf16cb9c0bd313f83bb87b876a065b8d396b

Family

NanoCore

If you wanna know how to analysis NanoCore Malware you can check my analysis in YouTube  NanoCore.. 


(25)

Sender ip

45.35.196.153

From

"BEIJING GUANGHUA TIMES CO.LTD <roger@bjghtimes.com>"

Subject

"Sales Contract & PO NO-00234517BE/2021"

Attachment

"doc-00234517BE.iso"

MD5

4b4b1585fe76a888eda17c40fb163e53

SHA256

11b09cc2d87dc87734ea25e219603fd0fc0b789b4605e4aeb56787f2a76d4e68

Family

AgentTesla


  If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

If you wanna learn malware analysis you can check my YouTube channel I'm trying publish analysis of malware and some methods to analysis malwares.
Please don't forgot subscribe my channel Than you ♥  

YouTube channel 
https://www.youtube.com/channel/UCParXHaBXBmqRdHuVUg21pA


Comments

Popular posts from this blog

Sunburst Solarwinds Backdoor

Phishing Attacks 9_4_2021

AgentTesla Malware