March Malspam Campaigns

gistfile1.txt

Date,Details,Email Payload Type,Users Targeted
3/1/2026,RE:CONFIRM PAYMENT INVOICE; zip -> originlogger,Attachment,2
3/1/2026,Your shipment has arrived; pdf -> link -> screenconnect continued to 3/6,Attachment,267
3/2/2026,Error synchronizing message ; rar -> js -> originlogger,Attachment,2
3/3/2026,BL DRAFT / 3425005143 SO 202552948280; gz -> remcos,Attachment,2
3/3/2026,Solicitud de precio; lha -> originlogger,Attachment,2
3/6/2026,RFQ FOR TOOL-EM78625; bz2 -> vbs -> xworm,Attachment,2
3/9/2026,Your 2026 Social Security Statement Is Ready|Action Required: Update Your Device Security; link -> screenconnect,Link,10
3/11/2026,"Re: CMA CGM China Ltd � SOA Confirmation Needed USD 15,452.81 (Dec�Jan); rar -> xloader",Attachment,4
3/11/2026,Purchase Order Stock-8787 -IAT; 7z -> bat -> donutloader -> vipkeylogger,Attachment,2
3/12/2026,Revised PI RGP-00332-19; xls -> hta -js -> remcos,Attachment,2
3/16/2026,RE: RE: CONFIRM THE PAYMENT ASAP !!!; zip -> xloader,Attachment,3
3/17/2026,Fw: Proof of Payment; rar -> js -> xloader,Attachment,4
3/17/2026,Re: New PO.; rar -> originlogger,Attachment,3
3/17/2026,Action Required: Please Review Your 2026 Social Security Statement; link -> datto,Link,5
3/18/2026,NEW PO 36222|REMINDER: URGENT ** : -SO/MON/015; rar -> originlogger,Attachment,3
3/18/2026,IRS: Refund Status Update; link -> screenconnect continued to 3/25,Link,3
3/18/2026,Cargill Standard Purchase Order 20260694_905103368_60028630-3-2-1; link -> vbs -> guloader -> remcos,Link,5
3/19/2026,WIRE TRANSFER; rar -> vbs -> originlogger,Attachment,3
3/19/2026,RE: AAA SOA FOR THE MONTH OF JAN-FEB; xlam -> hta -> xworm,Attachment,2
3/23/2026,Re: CFA0821260// CFA0805134; xlam -> hta -> xworm,Attachment,3
3/23/2026,UPDATE YOUR SSA E-PAYMENT STATEMENT!!; link -> vbs -> screenconnect,Link,7
3/23/2026,Attachment name is INQ26-012207.rar; js -> purelogsstealer,Attachment,2
3/24/2026,Re: New Order PO#222602612; rar -> js -> originlogger,Attachment,2
3/25/2026,RFQ_001 24.03.26 From Nedspice Processing Vietnam - Supply chain map; link -> gz -> vbs -> guloader -> remcos,Link,10
3/25/2026,Purchase Order PO G2605-3445 For invoice payment; lzh -> js -> originlogger,Attachment,3
3/27/2026,New Order March 2026; rar -> js -> purelogsstealer,Attachment,6
3/27/2026,Purchase Order PO G2605-3445; 7z -> originlogger,Attachment,3
3/28/2026,TELEX RLEASE MEDUWK377101; arj -> xloader,Attachment,2


darkcloud, 1c7376d94977591ba486c5b5e6fb4ec7bf84e13cbd37c51ae49a4935e36849a7, mail.hollyhotelmyanmar.com
darkcloud, 279a7ad5be46888ccda508e413e15f6d3ee37a78c396171b3c8f3ebaf95ade28, notaria192cdmx.com
darkcloud, 34671e45d3d03539b44eba27e6c78417cb0022bb38de9b96ca7e0f1e9507178f, https://api.telegram.org/bot8795912649
darkcloud, 6163ab22713dc71953638cd3fcc14c6b142a88ab842c528ece5ea5f2e5be9e21, ftp.khenghong.com
darkcloud, 7453b269f3a38abda3d9e99702036f5f546ceb83108371693f3f62780e07ae5d, bpl.com.mx
darkcloud, 76a6874c692e69f4e3c73b82515537033dbc4fd5f1628b9c40580c5231668271, mail.hollyhotelmyanmar.com
darkcloud, 893e8fad67156615d67509706a75bd5c7031f94914c2a39336b22458896fcf53, https://api.telegram.org/bot8414336054
darkcloud, 8d9f8265ce85222ef929005522d3c45fc185cccd1ffca0b365ef3b2b165d7868, mail.hollyhotelmyanmar.com
darkcloud, a461c9d09734b885b06d6c5b21c87b1569d307b5d180ebb83ce89862edef5a90, bpl.com.mx
darkcloud, c63d675d88282db91149a1057b122a11a1bae3f17361941005aca4e14307f9b7, mail.bitousa.com
darkcloud, d38ef5cbcaca37040e9b629a5f9fc3179c171c80643808bd364f7312fdce236d, mail.hollyhotelmyanmar.com
darkcloud, f583ffd3f8a32243ed872e8a123f8ac6aa84d506d34a8792edd5e9ee41ba6c7c, mail.hollyhotelmyanmar.com
datto, 16b2d21cdea4c920b3f82af3c47b495ba3fc2652ae30fdb691bee51624ceabf1, vidalcc.centrastage.net
donutloader-masslogger, 1d9735c8d10949ca2322708580e98dd28045e81bf2db6ac4769ffd1d16561438, mail.taikei-rmc-co.biz
donutloader-originlogger, 7d004924f5423b4068b1997dfb3b98b1c4794e9c52c29e3e8b477631d6bc6359, mail.taikei-rmc-co.biz
donutloader-originlogger, e813c38d77394e96cbe31d088798a866b6eadcf22342a5149a46844dc84e16f2, ftp://ftp.corwineagles.com
donutloader-phantomstealer, 191dd7079969ccb6ce15556059be86747df67a252bf27905aebb8e0e803f9926, mail.taikei-rmc-co.biz
donutloader-phantomstealer, c5830b1e211c745c7b6bfe70b95b1145a799b71409039f671c51bf425e4bfab3, mail.taikei-rmc-co.biz
donutloader-vipkeylogger, 2c1b5c4603ba3a79bdb541f2eba98828781c742fdc0545bf45745cb3173575b2, mail.sourc3trade.com
expiro-originlogger, ad846f4c69c3ffc0399a4314cd9aabb3aa966c68f01e7106dd5165bd6c5a724d, ftp.aventour.com.mx
guloader-remcos, 0b8802cb3b4576d67290ab1a0d87a4802bbeea5008b29e9b83e84589c4dbd807, sleepythunder89023.4nmn.com:1940
guloader-remcos, 4cde03e51e6a2966aa49e07c0596fbc0703544f0928df0ecb120853cd21671bf, 161.248.178.69:2404
guloader-remcos, a8b3a9ea280d776d79f038ff5c2b3b095d8e0c1b25df954bce598e0733d8149a, 130.12.181.40:2404
guloader-remcos, fcce3b123e2bc56836eab78083e800cdaed7e84e14e3997d6e7090a34761dbcb, 130.12.181.40:2404
originlogger, 0295cdcd773395a045c54f3f928a0556b6615861cf1bc92f1e16bd72e083ec11, forsacecobol.online
originlogger, 0e9c2713eb538590b38297840b4cdcd52e12a5c3b73c42530d9875ccd6c55ce6, mail.tiger-tech.com.tw
originlogger, 15b1b34eaeee9443647ea07147e09b497c0d5082de8b0b5eca417909e27bb0a9, ftp://ftp.corwineagles.com
originlogger, 1bae192ff0a9656f5ed172b1c031508d54a9adcd61dfd0c4d9385cf90c0b38d0, mail.duct-master.com
originlogger, 1cf02c7f7f62f22e6a225977f9f72d9e98b60e61409dad09d8beb89c80a33a9c, ftp.robotidegazon.ro
originlogger, 25f9e3f474b1a015cd410af97f32780ded388bb2cc4476c7f879f4d4309fa1ec, ftp://ftp.corwineagles.com
originlogger, 2a3411bc31cae594ece8f636fabbe629fbc6b11b554a6c5e7c635b00e0449ac2, godisgoodd.online
originlogger, 30dcf5b00caa20bdcd20aaab0c3ed0bceca35d94a0b5791df113ea2cfeea4d0e, ftp://ftp.corwineagles.com
originlogger, 31ec27a00665a8a2463e2d8364b21dbb9ed8753ac942522ccc849eb3c567aa05, ftp://ftp.duct-master.com
originlogger, 36865b07f6cbdb39fcd554db54b7df7d7023520449366af899a353192e8add0b, ftp://ftp.robotidegazon.ro
originlogger, 3756c250b313520c3f7277343e2f14c2098004699fd9fb4b7ace82c04dec0c20, ftp.robotidegazon.ro
originlogger, 3823c5baf2371cd528832fdebd14638f5829d490ace6e598b0a5a0442a8f8c26, https://api.telegram.org/bot8501998229
originlogger, 395e917012d660b8d5ce71f86488d97d4e9292086dc5b30d576b928871505d6e, ftp.abcebikes.com
originlogger, 4bd4c1eeb5ba86ada2b1afad4a6445edae69717bda5690ab967c4d3c4431649c, forsacecobol.online
originlogger, 557ed90fbcd85e84edbef5b5873bd8586e9bef24c923c32f4d42cc0b18b49d0e, ftp.robotidegazon.ro
originlogger, 5992a834e1bcdd68b42024c54a1e90367d8922aac7d8d3a8ffdd21fbe12e186d, ftp://ftp.corwineagles.com
originlogger, 6943d98c9665944bf66f10971f149e34297c005dcfc6cef83c25d7a9163218a8, ftp://ftp.duct-master.com
originlogger, 6e5d40295dff29fcaf56dc420d1d657a153b0245debf3fd8c13f9d1ecf323ca4, ftp://ftp.abcebikes.com
originlogger, 782ac2164a0d23b4e60c03c5f9722d52c7271b0a5531aa2b108463cf92507a67, 91.208.184.228
originlogger, 8163363141e4466928fdeb219fda2d099ac4d55c5e0b7a626e53300511d0ce8a, mail.duct-master.com
originlogger, 950dbae7693938581beaa07a588c393927cd315e981936d85fe32d309cc8dac8, ftp.scoalarmas.com
originlogger, 99f9f9125484b63c3abd922c0cdbad4ee8b85366f5fcbc2b391379a2295a2701, ftp://ftp.corwineagles.com
originlogger, 9be483c90186e01bcbf15272b95633855684f83a700f3dafeaa945dcc25bc707, ftp://ftp.martexbuilt.com.au
originlogger, a634cf61377f1cdc369362c5284e3874e9823301373de8c36b093b8ff0437ff6, forsacecobol.online
originlogger, af2d1f22ac1ea7c37f8c3a945e7aa18a9a3a52b34680fbd1ba3db68dca26d389, ftp://ftp.scoalarmas.com
originlogger, afe92b2d15043b10ec2fde12c06a011bf7f4e1eba1fc142aa8eebe157730e4b7, ftp://ftp.robotidegazon.ro
originlogger, b29c710a2a5c70a18fec4c4c54e7b2a588316f8145ed349b82988431a29fff5e, forsacecobol.online
originlogger, b982ee3dcfa99661be67b9b5b610398f3dd95538f7d97f754803be16b8117002, https://api.telegram.org/bot8581062014
originlogger, b98d25a7281d30e0644642845647ed3c0aa7ca38890418bc948007a8522e9a4c, ftp.lsgroup2u.com
originlogger, c6d18dd01ae4fd2db8adf18c6bf1876e14a6cd190aeefb12e3c2b3bb14843930, ftp.robotidegazon.ro
originlogger, d2d8a8caab7b31d6c38b9442cfa6e1619f7b9d348693be1ef0ce5999a12ad580, ftp://ftp.duct-master.com
originlogger, de63e0dac9cd8bfe25df3aed44fe5802fe142f022118b3e352c6028fccf9d2e9, ftp://ftp.hhautoinvestment.co.tz
phantomstealer, 14e2d790b1ec8d2c29a595b3b4d5e58ae49eec714e143e33fb340d992b0b6c90, gimas.bg
phantomstealer, 16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff, https://api.telegram.org/bot8676391589
phantomstealer, 207f46575ae45a1918ffc4fa21eb7069010a7b97d46b87604a57c53495a6c682, mail.mahefs.com.my
phantomstealer, 2aeb12afcb6e7eedd462e05947a8973faa1e334b73646901bb5a66fbe323739f, https://api.telegram.org/bot8517319813
phantomstealer, 3f470f09b2678cd0df645f1bbb33aa068a48a9ddded42798a9d1df85a822893e, mail.ekeindia.com
phantomstealer, 4286b1ef315edf02bbde5ffc281362ae96d2d8b73b62d06ed878bc0d8fef10fe, mail.mahefs.com.my
phantomstealer, 73ea1a25e53982c23589384c60d95fe3918830d739e8ed2d9e0496dd9c8d599a, https://api.telegram.org/bot8689117412
phantomstealer, c08f0093379918437a0f1c18f9236b6f7c3da6d6e63316fec04255891b4e1609, mail.mahefs.com.my
phantomstealer, db2b80cd7be5c7548932ce10c0ee09907d9fbbfeb8c17e213d3178492fc4c955, https://api.telegram.org/bot8756380362
purelogs, 513682c9c656a987739fbffaaf518424e589a3abc19ec475e516e7243e277220, 77.83.39.211:8443
purelogsstealer, 69764623ad18cac42c17d13d243c31f73ea24727b72374c4e7d5f93b6e46bccc, 41.216.188.231:4449
purelogsstealer, d75a8efd9ab6ce7f5e6fd25b6deab80cfcebef959ef45e639ce0f3090a838096, https://41.216.188.231:4449
purelogstealer, 03d48d476d5fed2076dfa7fae52ab64310f0442bbd84e32e5a53d5ca9093a1c4, 41.216.188.231:4449
purelogstealer, 2e9a2252e6120c4f3fd4dcc023d87fc75c052e9623c3d23e57f7557cb50e9620, 77.83.39.211:8443
purelogstealer, 3d510977d60a44322f88100b515f06cb5ed83babc64247068d1a489595faa6c5, https://77.83.39.211:8443
purelogstealer, 47fa296aadadf7242eae49ae92d78187129af87a4871bcf101b945321df2d031, 41.216.188.231:4449
purelogstealer, 867f0397c516ffe127367288f8113896afad498db7b559f8f5fcae967007e9ab, 41.216.188.231:4449
purelogstealer, d9c0913c0be2b20e93c4eaac52dd6dce96b0f67acd5f8b6fb7f7c754b85a1536, 41.216.188.231:4449
remcos, 505b686537a646709ea054f37fe5e53973dd3778ffc66f36b93b75389d3ef42d, 77.83.39.219:9876
remcos, 561e3780b6c1d17074806312b5f77378d8a9ac8088cc44389fb8a7f1b73850eb, 192.227.219.97:1477
remcos, 79f1e92b005e6dfd5e46140a69672b6fd74b6500673bad61fcecbf560d56e09c, 130.12.181.39:2404
remcos, a9cbb1b3305d042e03d3e94b2d9cb93e46a230e150e9843a837749b0217a0d2f, lucide.duckdns.org
remcos, b8464ed3baf9bcf768824e0c4baf2a08af3138118d4f2a9f399e2a85c4cd2149, 130.12.181.39:2404
remcos, d0672c59495401a4f705c1e9306bf20ae72ccdd412736262bb3eba2aa03dcc9f, sleepythunder89023.4nmn.com:1940
remcos, e7ab3703410656cf1aa6cd7fcc4cc1fd3b3fcf02a9c662307aeb2474e900253c, jimguy922.duckdns.org:37183
remcos, e96d879950e582d7c3f16f914a9ab11fe4b80f8a4aa9f32065a342fa288705de, lucide.duckdns.org
remcos, fd049aa61dbc6f9b398dee00ff9e2462e8cd32d2e9578d671ee971c60c883d6a, mikantiz.ansmtpariba.com:2091
reverseloader-purelogstealer, 3ddfa28b290b39aab8623a154e17862393b0491d63efde4c68e61a627d66576b, 41.216.188.231:4449
screenconnect, 6ae025a7f97da42ae5c82b4c6422d48c545e6fbf3a38551d1f6d433ec943a967, instance-g2wv1q-relay.screenconnect.com
screenconnect, 8a423c5d2e8718c72a67d6df5fdb1f358cdbce2374f8c5300a7cfe73066b65fb, 84.54.33.134:8041
screenconnect, 93b97d214ac445ceb2d853e394d8fa7368bc3f047bf50413afa7a4b8d5dd29aa, 104.249.130.135:8041
screenconnect, b06338b13fdd20cfe7ac6df38ec4af2c80ea7fff9fb4f8fb163ad34ef5ab7886, instance-hf5bd6-relay.screenconnect.com
screenconnect, b9867c0496db6645b9a8915d6598ba0588bbcf04e511177a6d4b9a2a4169fffc, relay.speedonation.space
screenconnect, f13aeee2cdb6680d92946d29d53d63da1dbee30088c47be092ec44b94a93096d, 172.81.63.231:8041
simplehelp, 173f22e43c4e0a07815b433eca140f4ade7514ab29a8b9fdd27132553c5dcb6d, funsunmexicobizz.top
simplehelp, 9aa5eba3f615706e050179537b7f12781e4feaf451ba52228ba9d9eb199b0d21, 84.54.33.134
snakekeylogger, 258c637a49e90a8ed3ebb9b9bbb4b0edd1f6d884d8cab83de7907a67d7ec3e36, https://api.telegram.org/bot8729572560
snakekeylogger, 4f5aca204276797aab39e792ded509c0e6a02805b2eba94bdb1bba5aa7e901d5, https://api.telegram.org/bot8736350993
snakekeylogger, 61061bd61fd9b9abc52c6041993114456744e4bde92f22423daea647b7f02c5b, mail.taikei-rmc-co.biz
snakekeylogger, c0ecfc9e5dded5f5e3e43db8d4927f0339c684a01605a413ad6e0f0e5fda5d22, https://api.telegram.org/bot8736350993:
vipkeylogger, cc8ae69961e9125fe349b6d8256cf2e7a917b31d28da8f0f8a7a916c04630e04, https://api.telegram.org/bot8736350993
xloader, 157fad6b982c00a0a6d1d8bd93da6f0af0b7083185ed1ef5f6eae736731e4edd, www.pronexibusplus.com/f193
xloader, 15d099d546f65a37b58a355a05283ed29a8d740493b750ef11b659a73a3ada34, http://www.bg5cxt.cc/3sgi/
xloader, 6364b2acf15d6f8c5c49ceaa93d6c4e22e71c428cf828c0e27b9b5fdbb5dbdfb, http://www.yiqud.xyz/0vth/
xloader, 659b3b4e08eff4f11d34a5b455953db929fa602dd679fee34b53a964c350d0db, http://www.mellowdew.co.uk/l5h0
xloader, 7425f75e57727ed43ef7c9cc4a646234736b2151641a51ada14db20152f2ccbe, www.is-technology.ru/uopl
xloader, 8e59fd060314be874b16a85af69bac2ca32bb8570698d635d33aa18c9b0d558a, www.malaro.site/zgoi
xloader, ddd653854d3fefd8deb33a2f989777a73b18a6149f0e31a79e3694487bd8f5fa, http://www.smartfavesden.shop/vvlv/
xloader, e025581e4547aca8179eab4417378cdfef5621043850491c657a5436c4432774, http://www.yiqud.xyz/0vth/
xworm, 27f555873ce5ab6b6cdbfa5690db3a663793be34e29917be22ef1e9cb1d2dec1, petro4prime.ydns.eu:5909
xworm, 341343a9a49fe35155b595825e762621605bfe38c7b2716b49740f640c006a0c, 158.94.210.122:6000
xworm, 4763e3ad120388a6536ad74e4c3d5dc915cc5367addc5fb11194a4947f4d2349, 192.154.241.18:3333
xworm, 49ea0d87c1edbf0a5895ca8a5698b422f3ce3981424241bcb3537ad6c7db09e8, berlin101.com:6000
xworm, 60cb82dbd319ab0101068fe86266d10d941f1b0497110bccd368d861ad2e8832, aaslooria.com
xworm, 6d5de61b4ceade81ec1a26f9d3c156344f0588efd20f35ed16ad9e50646c932a, petro4prime.ydns.eu:5909
xworm, 9b83c0732765e63022102b3e590f0aef07d488a0c967433ef38a8d7648b1fcef, 192.154.241.18:1960
xworm, b0758e108f0089817c0a73d2a1f4d5c4f79b0c0822bbe2e28b0e29c4f30ef456, petro4prime.ydns.eu:5909
xworm, c07ac71d6daf7d2fb45a66e96713770cf755c3e8b8f96a260d50ee5afa8aac1d, 204.10.160.190:7003

admin@forsacecobol.online
cloudbackup22@martexbuilt.com.au
cmo@hhautoinvestment.co.tz
dreamzlogs@scoalarmas.com
imustbeabillionairthisyear@godisgoodd.online
info2@corwineagles.com
log@taikei-rmc-co.biz
mohamed.bak@duct-master.com
mohammedddxxx@duct-master.com
officelogs@robotidegazon.ro
sales3.vn@tiger-tech.com.tw
senderftpoffice@abcebikes.com
snake1@taikei-rmc-co.biz