(1)
Sender ip | 195.133.18.153 |
From | "brento <[email protected]>" |
Subject | "RE: pago devuelto." |
Attachment | "Detalles del pago.pdf______________________________.gz" |
MD5 | 60ce782d8c140b615213c5a6c7439f0d |
SHA256 | 9ed3b4a1f25328f29981f22200b31679e9d0cbfa056578836e398781ca7f93f9 |
Family | Loki |
(2)
Sender ip | 188.225.83.191 |
From | "Julie-Ann <[email protected]>" |
Subject | "Purchase Order A00362" |
Attachment | "00010200390_0192021.pdf.r00" |
MD5 | 567d3152ce52b2492ade03fb1879cd8b |
SHA256 | 11b6828bafc1ad822f64a2fd6d36df2825f91b62a9f8e55b5ef396ae8f36fb2f |
Family | SnakeKeylogger |
(3)
Sender ip | 45.137.22.36 |
From | "KCTC International Ltd" <[email protected]>" |
Subject | "Revise Invoice to Euro Currency//Provide Euro Bank Details" |
Attachment | "KCTC International Ltd.zip" |
MD5 | 95a7490c9178c4adda884a3c1c101f21 |
SHA256 | ce6635b0dac51b6cd810ba3232f2cadae9257c36daef19159b305b96497781c2 |
Family | AgentTesla |
If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube AgentTesla.
(4)
Sender ip | 185.222.57.171 |
From | "Fawwaz Sawan <[email protected]>" |
Subject | "Payment was returned" |
Attachment | "Proforma Invoice.r00" |
MD5 | 53e32e0585e6e6f350acd5559a16ea4b |
SHA256 | 97d1d1810e3e4b893c8fd9a223ef8dda55a0817b02eddf39c8b1d651e9c06756 |
Family | SnakeKeylogger |
(5)
Sender ip | 142.93.105.132 |
From | "Sales"<[email protected]>" |
Subject | "RE: RE: the latest price lis" |
Attachment | "Price List.IMG" |
MD5 | 6d454d32d0f7082b1501237c76b5d9db |
SHA256 | 4d86f59ed10aea0a69e3eec23bb424fc19c8bb6e998f0034df66a0a260d3282c |
Family | Formbook |
(6)
Sender ip | 185.222.57.244 |
From | "Jong, Alice" <[email protected]>" |
Subject | "Shipping Doc ... RE: Revised Shipment details OA 14214 - LC Cable for Proforma Invoice No. 14214" |
Attachment | "Proforma Invoice No. 14214.r00" |
MD5 | d18408259775442e03bb7eb9b7a74bb9 |
SHA256 | 87876762e8b346df599bec5396da2cbaf7fb71236c2e77850d9edbae6aa9e906 |
Family | AgentTesla |
If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube AgentTesla.
(7)
Sender ip | 45.137.22.101 |
From | "UniCredit Bank" <[email protected]>" |
Subject | "Payment Swift Copy Notification" |
Attachment | "Payment Advice.zip" |
MD5 | 4851e7c2b7701a6ebc793392fe8ad21e |
SHA256 | b731a3e00ffad3116a3fa57992b948a94734278487405c877d9d902b1f3155dd |
Family | SnakeKeylogger |
(8)
Sender ip | 159.203.91.46 |
From | "pandey Raveendra"<[email protected]>" |
Subject | "Fwd: FINAL BALANCE PAYMENT SWIFT COPY $.16,436.40" |
Attachment | "SPECIALISED SWIFT.iso" |
MD5 | 9b2a82117289990dba47902ced3fce91 |
SHA256 | 6ba8016a065bf59fd4139d72d684b0b90f882c1256d4bee681ee6e84bab17446 |
Family | AgentTesla |
If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube AgentTesla.
(9)
Sender ip | 185.222.57.171 |
From | "Logistica Farmamundi <[email protected]>" |
Subject | "El pago fue devuelto" |
Attachment | "Factura de proforma.r00" |
MD5 | 1f29be41fd258c98132b0ae9adf210eb |
SHA256 | fc6d78bd78a5e42e7d1d2645aec3e437a90925635abde501c8a2ff2c8218293f |
Family | SnakeKeylogger |
(10)
Sender ip | 185.222.57.79 |
From | |
Subject | "RE: WRONG IBAN/PAYMENT RETURNED" |
Attachment | "GS998M37BeqAVyf.zip" |
MD5 | 80819ac7d6f73b2bcbfd4c088eb12d80 |
SHA256 | 2c74c934d6e8da3e5968ea367270bf40415ae4a3046b4c504cc694b98a6bf528 |
Family | AgentTesla |
If you wanna know how to analysis AgentTesla Malware you can check my analysis in YouTube AgentTesla.
If you wanna learn malware analysis you can check my YouTube channel I'm trying publish analysis of malware and some methods to analysis malwares.
Please don't forgot subscribe my channel Thank you ♥
YouTube channel
https://www.youtube.com/channel/UCParXHaBXBmqRdHuVUg21pA
Article Link: Phishing Attacks 13_6_2021