Jun Malspam Campaigns

gistfile1.txt

Date,Details,Email Payload Type,Users Targeted
6/2/2026,Fwd: ATTENTION MR. DANISH MEHMOOD PCT; rar -> darkcloud,Attachment,2
6/3/2026,New Confidential Court Document � Immediate Review Recommended; link -> vbs -> screenconnect,Link,3
6/5/2026,RFQ 102603813; zip -> originlogger,Attachment,6
6/5/2026,Document Access Notification � View Now; link  -> vbs -> screenconnect,Link,2
6/9/2026,Shipping docs 34328910949; rar -> purelogsstealer,Attachment,2
6/9/2026,Payment Advice - Advice Ref.G91222721471; rar -> originlogger,Attachment,2
6/11/2026,Quotation request 6572600197_00003221; gz -> masslogger,Attachment,2
6/11/2026,Solicitud de Cotizaci�n|Quotation and specifications; zip ->js -> xloader,Attachment,6
6/12/2026,Invoice S100346809.001 PO# WWTP PAA; zip -> screenconnect,Attachment,19
6/13/2026,Anexo de la orden 32454357. Por favor|Estado de cuenta de reembolso de pago; uu|lha -> xworm,Attachment,3
6/15/2026,PROFORMA N�260035-2026 21056,00 EUR; zip -> reverseload -> xloader,Attachment,3
6/15/2026,Request for Quotation � New June Order (FOB Dubai); rar -> xloader,Attachment,6
6/16/2026,Swift copy (807FTBR261590003); xls -> reverseloader -> remcos,Attachment,2
6/17/2026,port condition for discharging cement in bulk; rar -> phantomstealer,Attachment,2
6/17/2026,Payment Info.; zip -> donutloader -> originlogger,Attachment,6
6/18/2026,Payment Order; rar -> vbs -> xworm,Attachment,2
6/18/2026,RE: Payment $33,960.00 Now Overdue; zip -> originlogger,Attachment,2
6/18/2026,Proforma Invoice; zip -> xloader continued to 6/24,Attachment,2
6/20/2026,Sending ip block is 77.83.39.0/24; docx -> rtf -> vbs -> xloader,Attachment,8
6/22/2026,ATTN: Complete with Docusign: Review and Sign Agreement (2026) When Available; link -> screenconnect,Link,214
6/23/2026,Page; rar -> js -> snakekeylogger,Attachment,2
6/23/2026,Orden de compra POF0000095; rar -> vbs -> originlogger,Attachment,2
6/24/2026,Re: Wrong IBAN NUMBER|Quotation; zip|rar -> vbs -> xworm,Attachment,2
6/27/2026,Inv 2602181 PO L 149661 SO 2219660 Yccnet; zip -> donutloader -> originlogger,Attachment,7
6/29/2026,ADVICE FROM STANDARD CHARTERED BANK - REF:3400010748590025; rar -> js -> originlogger,Attachment,2
6/30/2026,Fw: Draft Shipping Docs and BL; rar -> xloader,Attachment,6
6/30/2026,Quotation; zip -> originlogger,Attachment,4

automox, 63907b77c850904dc3474bb9b109574a94330d23751db109a1a0b1b2bc6633f7, rtt.automox.com
clickfix-stealc, 060384a3c52dc9ff09e5d8aeef52b310a41c4d97e6133e7eba6a59e138736935, https://pas.canamrent.com/
darkcloud, 60d5cfb89c982a73d92f700f982bbea72180b47bcef2f870572a12d7f198263a, https://api.telegram.org/bot8601607746
donutloader-masslogger, e378354b49d513292c0c6cb4b733dd5b3bf64fd4d706830b0fb1ab2a158a6b86, mail.trimnt.com
donutloader-originlogger, 2007fded27c19bc668382b4f6bf97b6b437d74fcc9bfb813b533655eb7708709, ftp.maytestlasb.com
donutloader-originlogger, 9cb040c0df025901336cb0c6354d8b2cbc746ce951cca6070841cc41f65abf74, ftp://ftp.melrz.com
donutloader-originlogger, bc73fe11955ff97c6eb8b3e5a85d02c5fd728103c046f85150b8e8d13c16c939, ftp.piovau.com
donutloader-originlogger, bfbb0a7e74db621c6e76fa399b664338394b84796d152a4115045eb80aa9b706, ftp.melrz.com
donutloader-originlogger, d1d0df395184892b0be7e7d6a8b2e310e2e80a424a95f9076abea84782d3fced, ftp.melrz.com
logmeinrescue, efb01d05dd267ca9708f9cd5a2ff827b08922cf10802c9a5dc35fb6e140cce53, console.gotoresolve.com/devices
masslogger, 018fe5bd0c2101c546959da962776443c83e5ed6f7c9d5aaf621ddde3e985904, mail.neptunfisheries.com
masslogger, 022b876ca9d0ab0ed7ac4619763a389681bb593ab691371ef1098a4ed1f99d6a, mail.trimnt.com
masslogger, 0f3dfd44c6bfa56485d6ac972acc0465e47e71afe0889ab83049ac0ee5bbf942, mail.gfbcorp.com
masslogger, 1f49effe122ada5b31856c5f3f9a230786fc267f65527fe9199820aa6e547237, mail.sepcon.net
masslogger, 3e5b5bc7054d240c93904e71e7934261057636152a3f95292b325a7d0442b884, adsgroupsac.com
masslogger, 6cd900620e1ca921c028ad02e78e082d90351ec2a96c34ac532249f5fea16c3a, mail.trimnt.com
masslogger, 9d6c0643e954b2f82ca423628543e0d58f47c9fd7e9fddf4ceea404a0dd918bd, mail.trimnt.com
masslogger, a96f066e3ae67ccc22e5b15467a6bf8c1e35de2afea05722528221e4db827f0e, mail.climasecomfort.com.mx
orginlogger, 7881aa8363eeaa52111abeb6a1178efad0e948626e00b2b825d0f128aeb047fa, ftp.telewatte-pe.com
originlogger, 013e0807afdbbe14fe30a302620f31147fc03caa771ff9bd7951347acdb5ecb0, ftp.robotidegazon.ro
originlogger, 11b9073852f11ed8fde575b3b7a3706407df4a4b77fa484fb57be2d064221d9e, ftp.melrz.com
originlogger, 31e351001b4b4cfad664fcb3d0eda202cd643215611bca3123e1167f0faf3af3, ftp.ltcresource.com.my
originlogger, 57611923cfd0dd7950a80002585ea815799bd3a99d622326b0a0cfccb710e29a, ftp.corwineagles.com
originlogger, 62b5b78f80d371eb50e98ce67a45df37192936498e88f2184366631c95eb81db, ftp.robotidegazon.ro
originlogger, 63960c6aa8b507e137fa4c7ce26709505747682003bb54de4236f8a14dd65886, ftp.duct-master.com
originlogger, 6597834f5d739a5fcec0c0ec1b2e828e9ddc170b2ab6fbde7daa752563af16f5, ftp.corwineagles.com
originlogger, 68342135a1fc950275e20600e8ebbf62258744f26adae735a73fff741d75aca8, ftp.altatsradgez.com
originlogger, 7a48766df7441a83b64c58167443a3c6f7312e6c12d83ab47081e3adbcafa74a, ftp.maytestlasb.com
originlogger, 8dffead0450847a53d2c7d585aa2150acc44a4813ecbd31f0e7f6c61d7b08c05, tomsindoputra.com
originlogger, 99bee9c7498d8bbf660140795ad31220000a408d8234f58bed07939779ce0ed4, ftp.ltcresource.com.my
originlogger, 9d5ad9a5262bd3869350cc8651b5693582b46e6b117b380794b2d720f41f0366, mail.aarcorealestate.lk
originlogger, d6447792486b2abbbeedcef93e06d60091b1786623099a2533a3723d5debf7e1, ftp.telewatte-pe.com
originlogger, dc12faa460faab18a12d8ac33fb3a3a96c95232cff2f124df15300475cc20486, mail.frasol.org.br
originlogger, e1e439fae76f15873089c8ded9353affb97435ab10a8a7120d8461dc706a3539, ftp.robotidegazon.ro
originlogger, ef013d902ac3621b21285d8a9cfd2239baddc5f1f4c5fe6b2f06e30ff3cfc0a0, ftp.robotidegazon.ro
originlogger, f20984f5fca2410b4448938f57aa3aacd913fa6e64a5f85d813b775d039a3418, ftp.enogcaen-br.com
phantomstealer, 7766f092e4abf80212baf467efbf37655b6b97448d351513dc8dea148e6a801d, https://api.telegram.org/bot8798187396
phantomstealer, 95911c7c29bc61406d8ba01d63f9d6d238875b7f1f5d2347f05163b288163602, https://api.telegram.org/bot8826141631
phantomstealer, a1a64e53591cc747ca8a9b906bc83ea3d6394aba5fa6a0d7a4a4acc725407a5e, bostonwindows.com
phantomstealer, c263ac4338a05f8a8eac1a2eafb0ea4fac59c5c012a59b927c77dd41fd3536bb, bostonwindows.com
purelogsstealer, 4c584c37ccafab4dd5afe80d8146aa2cbe3eb8e10983512fb5074c75375c8462, 2.27.62.123:4449
purelogsstealer, 6e960c4908295aa96d02c15e56409d1824d75a62e317006140ce3d471ccb933d, 2.27.62.123:4449
purelogsstealer, 9dd17f480319c584f8dcd48ed79548572eab9b89f717a37afea9ffd7166aa87b, 2.27.62.123:4449
purelogsstealer, c9a756a44b62f66d5b69a8ad643a52f14f9bbbe6f1aba92399e127537774f1e2, 2.27.62.123:4449
purelogsstealer, ea56213fa9cddb08dae3b254c36665d44991f57dace4afe578c1c8f0079187af, 2.27.62.123:4449
purelogsstealer, f1ab17a8f48fa24208daf237e9ec6ba0c39787234408362ec5d35d122f6d5e1a, 2.27.62.123:4449
purelogsstealer, fcf0dc8ac4514016c2a03850a1012b9d9fc4932d03624e77c03609f696dd5f4e, 2.27.62.123:4449
remcos, 3da0d51f91991cea4662201e46fa87e7e9b7c74d4704fce249813b76ed48ed0f, 103.67.163.0:2404
remcos, 71305d4216f763c51fa65f5b3819c2ae0e971720c0653e151c3f14b0dff85ea4, 130.12.181.40:2404
remcos, c52315c118626b36dd8225235b0d62afe6a75565eab7cdc498b13e513d664666, 172.245.155.86:2404
remcos, d113f72b9248e3a89d72d1238a8465af7857822b82951681cff22391ffff3039, 173.231.188.244:14641
reverseloader-remcos, f3ed2086f431f34904d3e0f67dd2188a6446d613e6b923b406380309c2ce0039, 173.231.188.244:14641
reverseloader-xloader, f8a43903e5b50696f3bbb98f0221bfd5ba95c5a6e05ca26400b4fc151a489635, http://www.flipmoneyapp.com/luz4/
reverseloader-xworm, a63e7dcefe717a6748bb223c17593b13918677dc82cd06468cd58bc891cd53bd, 172.245.106.54:3333
screenconnect, 00bfb7807334fd540f7c03f906cc3eceba2c9d35540213520d0c7c71c51c9339, instance-jxog3a-relay.screenconnect.com
screenconnect, 1254c8f52f2a786f4a83e44bf379496d05e4c219db44e29f27f21223befa01ec, instance-hqkho5-relay.screenconnect.com
screenconnect, 611890a0385297e72cd1b2b923d62fe326268082644b9fe9e31544e2e0f06606, 142.202.189.49:8041
screenconnect, a903a9e5f6755981950528b54a57fb48ada724523542eb54ad2a28d56a168f80, relay.biggertwitter.com
screenconnect, b67d5de826021305397a25d165d9f219661a9da439201ea026ea54f88df95b03, afpbs.com:8041
screenconnect, cdb36bb08762aa6741c80529eec30417276bfdaf09174b3e4a27a11785211ea9, instance-wd0g60-relay.screenconnect.com
screenconnect, d155b793e31dd7be130bebfcbeb26d6b9f41e9992b79bf364f73522b4b9ec4c4, instance-l7g4qt-relay.screenconnect.com
screenconnect, ea5f12f3f4053d653f1b190dc229f063f94524c50f49ceb74183424f472961bc, instance-x1lr5n-relay.screenconnect.com
screenconnect, ef22c710ffa79ee80fa356d21663c28336cd3447c0bcf07ece1e087937a6f6dd, instance-c2md8y-relay.screenconnect.com
screenconnect, f19ec0861447eabc32eb3716b956ef67421f7c759d175151b4377ef061651889, relay.biggertwitter.com
simplehelp, 6a9d1469903eb84330c6babf7f889d90f93b321447278e755530338a965935a0, http://91.92.41.117:8008/
snakekeylogger, 063f4715cbacd71b07e2bc0a7f47d5e859e081c2dd9182f32cbbf39938095edf, mail.sepcon.net
snakekeylogger, 14c618dec5ec31c655ae3c518d2af66c6b5e44162b68c20e725f1ab76bf281cd, mail.nissanalmenar.com
vipkeylogger, aadfe021f937eddbb71eeaa4f109221cce0bbb2607ef26e41ecd6a31e06b5509, https://api.telegram.org/bot5718429344
vipkeylogger, e101122360c065faa194cb0ccb4348713235b63ac87183cdebeee4f7cba3bcac, cphost17.qhoster.net
xloader, 0e44300f6f2d8f1d3907d25a8f99bd6236c540a5a65c5cf7af0d40c68f2d7387, http://www.rnlforce.com/qw0c/
xloader, 5d3336e73a6ae8c166510f10919b2014bd0a05ddb0ad622de9a27df4cc52e65b, www.cupbones.vip/8b6u
xloader, 665bb2de40d8b6543aa72b209ab9116734d57990561858f8ef3b24afd65339a8, www.prilow.life/i99s
xloader, 86b4e9a085c6b096e0c6bf254ab14752e204965eb797568c64fb54d784ce44a3, www.pafiiditunong.org
xloader, 8b9e4f92bb9551e01ed45c1fffaef2c8771e3a84e01c0fdb6bcec4a7428e0621, www.directordesk.top/2qsb
xloader, 97894eccb6b591f2176e28068418b4cdb7d8ef439680b55936cc0189d4dff6c2, www.domame.website/ep8a
xloader, 97d38f358fcd1829bd281b8218e7ee32cd2ea0b0e649adea2dc25ecf168751a8, http://www.mutiusinazita.com/4b02/
xloader, a1271b9b50b806efd698e97d443f341e4921a906ea48d22002ba84a91f89df6e, http://www.aivow.fr/p7uv/
xloader, b00fb63de14d48996d948227f6fc5e044a2d6122e13be8d79382e478405cc769, http://www.pafiiditunong.org/ihgp/
xloader, bd1b6a05dbbb3958e921538acbd2765e3035cc63ef3e476c09805e20f8f9a1a0, http://www.pafiiditunong.org/ihgp/
xloader, c32590372184842001ba5ae8f4f569352a1b65ece5ec31e4974b717b821362b3, http://www.aivow.fr/p7uv/
xloader, d6d6f9c0160cf7bfa97097f58f6acf8cafc8bd657b7aebbd326fea05e9bc3165, http://www.flipmoneyapp.com/luz4/
xloader, e476b673d08dab9c05a1a02448c2a925b4c75a9d00d8d84460844aa65ba2ecac, www.32308172.xyz/k7ee
xloader, e50e2fd4c61ba461a322f1d5a0e902983af962b3937e12c285e0e2c14c8319ed, www.alogatin.xyz/06sf
xloader, fac3bf7ac5e4fd0a0840486d42180a84350c8fa3799e1f7568d0326e9827cac9, http://www.onyudental.co.kr
xworm, 04bff0171f60b04c4654daca79dcda612bb9aa501d4d4e12cf8c8f0efa89b03e, 203.202.232.149:2222
xworm, 06798ab00b4cb050918236f0ac5c3a30252dadfe6c8e7563e276966e7727c055, petro4prime.ydns.eu:5909
xworm, 1c76b869dd81eaefa28ccb9124c46eaac76f4399232bfa6065ef6b4ea2751e1c, petro4prime.ydns.eu:5909
xworm, 22620c9c6d0c2b392ee34bd4e7905b6f161bfe25ed3dc756302aeb091a994b0e, 103.83.87.182:2222
xworm, 29959205ea2e521181bcf94150fb57aa78e3661c361234f27a5de2afb254e7b8, petro4prime.ydns.eu:5909
xworm, 44760ec58f066892b58f50330093213d3bfb0358d74f735010aaf54585712b34, petro4prime.ydns.eu:5909
xworm, 5b24980d605b28c0863016aa90f67ccad03fc86f872896b031aa28f7e6e6072b, petro4prime.ydns.eu:5909
xworm, 858727d7d910a029cd5238ebec8c6cfc90593347dfd2172bd896345da82a6dbb, vvcc.ydns.eu:8793
xworm, 9a2efe3df697037fac5fdc4b70ff84086e64fd6d9f82c9335992a2dd0ffb0abd, petro4prime.ydns.eu:5909
xworm, a951afc09aa3e8be61204a027c2cc0c141a64792a2022b8d6ebdf8e0e54a2279, petro4prime.ydns.eu:5909
xworm, b064db45193ce571396ff195824ae113a33af2ad516bfe2322ea13c9cc1ce2c4, eminley.ydns.eu:5960
xworm, d56bd06a68d33a1d07b75d1caec577a592dc7ea893d34153746b0d4cec21de58, petro4prime.ydns.eu:5909

administrativo@frasol.org.br
almacenmalvinas@sepcon.net
bachtiar.mahaputra@tomsindoputra.com
beautyv@ltcresource.com.my
cloudbackupdanny@piovau.com
doc@altatsradgez.com
email@aarcorealestate.lk
gcatala@nissanalmenar.com
info2@corwineagles.com
Jayclu@maytestlasb.com
mohammedddxxx@duct-master.com
noreply@melrz.com
officelogs@robotidegazon.ro
sybkyp@telewatte-pe.com