Phishing Attacks 27_9_2021

 


If you wanna learn how to detect phishing emails  only by your eye , you can check my udemy course here 👇.

My udemy course

(1)

Sender ip

45.137.22.156

From

"gkcmumbai@gmail.com<gkcmumbai@gmail.com>"

Subject

"Re: Enquiry"

Attachment

"PRICE QUOTE.zip"

MD5

05c141b39bb4c908a420a13d56260657

SHA256

759dab60f58018203d219a229e69a2af9adc96cfc46cfa28f2877af8648777b6

Family

AgentTesla

   If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.


(2)

Sender ip

108.166.43.78

From

"Bsawyer"<jbennington@fathomrealty.com>"

Subject

"Your order: #RS00HNAWZ1"

Attachment

"#RS00HNAWZ1.iso"

MD5

84a0b17fb49483b8b0fa79066d87afd1

SHA256

2507f3526d4419945b1091542eeca79de74602e5cea24b14492fe14be66d7ab5

Family

Vjw0rm

 

(3)

 

Sender ip

45.137.22.115

From

"Cathy Yang <fraser@impstar.org>"

Subject

"RE: RE: 90% BALANCE PAYMENT INVOICE 1394,1395/21-22"

Attachment

"swift00098765456NMLO.zip"

MD5

a5e55107f754fa83badfbbd34aba0ab7

SHA256

7bcd80864e8f7f0dfd8a0f2694b8f3e9a1bb443cd8e8ec86305422e6b5b2c0db

Family

Unknown

 


(4)

 

Sender ip

185.176.221.189

From

"Dhl Customer Support <mail@deliveryssl.com>"

Subject

"Delivery Failed"

Attachment

"Attachment.iso"

MD5

c61bbf21647bcf6d7482d0e765baec65

SHA256

a6dcbfef14af69bd9635305dac92f09a3bffc67453d777b41d2c09345c354fdb

Family

RemcosRAT

 

(5)

Sender ip

104.168.204.20

From

"Faruk Ahmed <admin@zicomgroup.live>"

Subject

"NEW PURCHASE ORDER FOR URGENT RESPONSE $180,000"

Attachment

"NEW PURCHASE ORDER FOR URGENT RESPONSE $180,000.rar"

MD5

0266a43bd817ce7a594fe36784443567

SHA256

8aa0c9ab87da8ca53599e758b5061fb9a6ef1502ef60538835f2b9ae1d6356ad

Family

AgentTesla

   If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(6)

Sender ip

185.176.221.189

From

"Dhl Customer Support <mail@deliveryssl.com>"

Subject

"Delivery Failed"

Attachment

"Attachment.iso"

MD5

ed5a7b6c398627a0e30d56ed4a811fb3

SHA256

8887416f03acd7c498c9e891fde30e3503b8a5fc9c31d11bb0c04815f45f27d0

Family

NetWire


(7)

Sender ip

193.56.29.111

From

"CARAVAN Sales <sales@caravanmr.com>"

Subject

"RFQ-910015 CARAVAN GROUP"

Attachment

"RFQ-910015.xlsx"

MD5

51cfc4755260459f4417f9ed5c85b0e3

SHA256

25ac56fa9637967ae898c22748283b3655c5dcb00f3c9100d6e787b45e9e4714

Family

Unknown


(8)

Sender ip

31.210.20.38

From

"BITCOIN <btc@aonbd.net>"

Subject

"New Btc Policy"

Attachment

"FULL BTC POLICY2022 INTL.PDF.rar"

MD5

a42021d9e55675d7f14d76f9095798b0

SHA256

c70a438d7d83606c0de95316aec263df0e914f21375089e33fc165c094e33d23

Family

unknown


(9)

Sender ip

31.210.20.38

From

"JESSE BOLEVAN <jsse@aonbd.net>"

Subject

"New Order"

Attachment

"Order_67289283828289.zip"

MD5

d6351e3046f31284599623b4a033041c

SHA256

ce9ad4f8dd11515d83ae00f791e665f445867cb2a9176f5fb3afc6c7669cb4da

Family

Unknown


(10)

Sender ip

103.133.109.71

From

"DHL Express <delivery@dhl.sg>"

Subject

"RE: AWB #6913321715 & SHIPPING DOCUMENTS"

Attachment

"AWB & Shipping Documents.tar"

MD5

9673abd07490321eadd85557b33b4dee

SHA256

6aa6b71dc678822b714af3634efb002dd0d0e7ca0c3cf0e4040989a1c3914029

Family

Unknown


(11)

Sender ip

103.125.190.56

From

"lgpartner.chAdministrator@lgpartner.ch"

Subject

"QOUTATION CONFIRMATION"

Attachment

"AWS QOUTATION 768854_SCAN_PDF.rar"

MD5

a55c09a332d66944bc6ea102b5375495

SHA256

4054e74d768d7fac206b141d7c01cef8a9345f6b9741758b0e56bde21518c0b9

Family

RemcosRAT


(12)

Sender ip

45.137.22.48

From

"Mohamed Al Mazrui <thaotran@longtruong.com.vn>"

Subject

"Re: *URGENT*- Payment to bank details (CONFIRM BANK DETAILS)"

Attachment

"Bank details.lzh"

MD5

"Bank details.lzh"

SHA256

9e5b19bd45bde27361505fd750b2537f2b83eaf2ece6bbcbc20f595d99e8384d

Family

AgentTesla

(

  If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

13)

Sender ip

199.10.31.238

From

"Josey<josey.teran@mountztorque.com>"

Subject

"Mountz, Inc.: Purchase Order #PO226520"

Attachment

"Purchase Order_PO226520_1632165053105.rev"

MD5

edf299482cbcfa08f808e2fa4b5e6a8d

SHA256

a0e1b5c3ee9b881556c44f34851ab539c892e9e585645e4922446e1f46655946

Family

Unknown


(14)

Sender ip

185.29.9.105

From

"Lucia Pancini<docs1@paarglobal.in>"

Subject

"PO for New Order"

Attachment

"PO-IMAGE-SCAN-00HD878HE485HDYTE.rar"

MD5

ee6701a8830a5c3bd99a2e58c8aeeca1

SHA256

b38fb86423029b7c8cb1f4a426606001647d4b7c6950a46fc552b438c9f6ba96

Family

AgentTesla

  If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube  AgentTesla.

(15)

Sender ip

185.222.58.155

From

"Anil <anil@jinasena.com.lk>"

Subject

"RE: PURCHASE ORDER I 5083 - 2340212"

Attachment

"PURCHASE ORDER I 5083.r00"

MD5

aa157b553888eac217edcf018295f240

SHA256

b1b4509bb3b6ac1ead9e61ac865f04ae862fef2f905043d06d5546ea607f4536

Family

Formbook

If you wanna learn malware analysis you can check my YouTube channel I'm trying publish analysis of malware and some methods to analysis malwares.
Please don't forgot subscribe my channel Than you ♥  

YouTube channel 

          https://www.youtube.com/channel/UCParXHaBXBmqRdHuVUg21pA 

Comments

Popular posts from this blog

Sunburst Solarwinds Backdoor

Phishing Attacks 9_4_2021

AgentTesla Malware