Skip to content

Instantly share code, notes, and snippets.

View silence-is-best's full-sized avatar

silence-is-best

95 followers · 0 following
View GitHub Profile
@silence-is-best
silence-is-best / gist:fc8f995f2c188ce22d8cc6c424290d56
Created September 1, 2023 14:08
August Malspam Campaigns
Date,Details,Email Payload Type,Users Targeted
8/1/2023,RE: FINAL INVOICE ATTACHED; docx -> formbook,Attachment,3
8/2/2023,Quote Best Price Offer; zip -> agenttesla,Attachment,2
8/2/2023,fwd: Proforma Invoice; z -> agenttesla,Attachment,3
8/3/2023,FEEDER DELAY NOTICE; rar -> dfarkcloud,Attachment,4
8/3/2023,Sv: EXT: Re: AW: Re: Sv: New Order PO; doc -> agenttesla,Attachment,5
8/7/2023,Re: URGENT: Immediate Payment Required for Invoice ME01-72; jar -> strrat,Attachment,5
8/7/2023,Attachment name is RFQ# R&E-S194.rar; rar -> formbook,Attachment,4
8/8/2023,DocuSign!; pdf -> parallax,Attachment,4
8/10/2023,Swift Payment Copy; z -> darkcloud,Attachment,4
@silence-is-best
silence-is-best / gist:da3e2f38fbac1f9e946b582456ad3a06
Last active August 2, 2023 07:38
July Malspam Campaigns
Date,Details,Email Payload Type,Users Targeted
7/3/2023,Anbei unser Angebot als Referenz; jar -> strrat,Attachment,4
7/3/2023,SWT131 03-07-2023; jar -> strrat,Attachment,2
7/3/2023,New Order; z -> agenttesla,Attachment,4
7/4/2023,Haziran-2023 Ekstreniz; bz -> agenttesla,Attachment,2
7/4/2023,RE: Purchase Order; r15 -> agenttesla,Attachment,3
7/5/2023,FWD: FYI: ATTACHED PAYMENT SLIP; xlsx -> agenttesla,Attachment,7
7/6/2023,Re: Re: packing list and Invoice; doc -> xloader,Attachment,2
7/6/2023,Re: Re: packing list -  ????DO16191; xlsx -> xloader,Attachment,2
7/6/2023,NEW ORDER 7/6/2023; xla -> agenttesla,Attachment,2
@silence-is-best
silence-is-best / gist:b159cc410068fa15d21c1cc653b20333
Created July 5, 2023 19:26
June 2023 Malspam Campaigns
Date,Details,Email Payload Type,Users Targeted
6/1/2023,Release pending bookings; rar -> formbook continued to 6/6,Attachment,6
6/1/2023,RE: Purchase Order -1st June 2023; img -> purecryptor -> agenttesla,Attachment,4
6/1/2023,Hesap hareketleriniz; xz|rar -> agenttesla,Attachment,4
6/2/2023,Is Bankasi-01.06.2023 05:00-02.06.2023 04:59 4157-0002689 Numarali; xz -> agenttesla,Attachment,2
6/2/2023,payment made to your account; zip -> agenttesla,Attachment,2
6/4/2023,Complete pending bookings; rar -> formbook,Attachment,3
6/4/2023,pending bookings; rar -> formbook,Attachment,6
6/5/2023,DBS(Doğrudan Borçlandırma Sistemi) Bilgilendirme; rar -> agenttesla,Attachment,2
6/5/2023,Re: Payment Notification; 7z -> modiloader -> remcos,Attachment,2
@silence-is-best
silence-is-best / gist:c4e3593a157aefcce7931a6cd4908b07
Created June 23, 2023 18:51
Links
https://8-4.oss-cn-hangzhou.aliyuncs.com/1045.jpg
https://8-4.oss-cn-hangzhou.aliyuncs.com/1124.jpg
https://8-4.oss-cn-hangzhou.aliyuncs.com/1127.jpg
https://8-4.oss-cn-hangzhou.aliyuncs.com/1143.jpg
https://8-4.oss-cn-hangzhou.aliyuncs.com/1159.jpg
https://8-4.oss-cn-hangzhou.aliyuncs.com/1195.jpg
https://8-4.oss-cn-hangzhou.aliyuncs.com/1197.jpg
https://8-4.oss-cn-hangzhou.aliyuncs.com/1226.jpg
https://8-4.oss-cn-hangzhou.aliyuncs.com/1939.jpg
https://8-4.oss-cn-hangzhou.aliyuncs.com/1953.jpg
@silence-is-best
silence-is-best / gist:5ab41579867ee386e31293c0f527dc8c
Created June 1, 2023 20:15
May 2023 Malspam Campaigns
Date,Details,Email Payload Type,Users Targeted
5/1/2023,PO 211436; z -> agenttesla continued to may30,Attachment,8
5/2/2023,SUMMARY REPORT; r01 -> guloader-azorult,Attachment,5
5/3/2023,Attachment name is bl017351-00691mdl.r01; r01 -> guloader -> azorult,Attachment,2
5/4/2023,Attahment name is PL59107-00.r01; r01 -> formbook,Attachment,2
5/5/2023,DHL AWB DOC; ace -> stormkitty -> snake,Attachment,4
5/6/2023,New Purchase Order HBR-1053; rar|zip -> agenttesla,Attachment,2
5/8/2023,RE: New Order NO.Z21239; pdf -> xml -> strrat,Attachment,5
5/10/2023,2022 1099-NEC; html -> zip -> jar -> adwind,Attachment,2
5/11/2023,PO 211436 // Weatherbeeta New Zealand.; z -> formbook,Attachment,2
@silence-is-best
silence-is-best / gist:5875ab147f1511a31914cd20771824b7
Created May 24, 2023 01:47
OpenJDK scans
119.236.115.13
119.34.179.192
119.86.28.44
121.29.80.27
123.203.12.158
123.203.175.109
155.137.137.54
183.179.40.206
203.77.73.65
217.121.1.179
@silence-is-best
silence-is-best / gist:d168f4c94f59e444a1081751e9dc79ca
Created May 1, 2023 14:34
Apr 2023 Malspam Campaigns
Date,Details,Email Payload Type,Users Targeted
4/4/2023,Attachment names is Stmnt0985.htm; html -> qbot,Attachment,2
4/5/2023,Shipping Documents VI210034; uue -> darkcloud,Attachment,2
4/5/2023,New PO - 23010; zip -> formbook,Attachment,4
4/6/2023,New_Order#SQ031776; cab -> agenttesla,Attachment,10
4/7/2023,Ibile Attached Payment; 7z -> agenttesla,Attachment,4
4/10/2023,Türkiye İş Bankası 10.04.2023 Tarihli Hesap Özeti - 659923163.POS; xlsm -> azorult,Attachment,2
4/10/2023,QUOTATION; gz -> agenttesla continued to 4/17,Attachment,2
4/11/2023,RE: RE: Sea and air /ANTEK Co.Ltd.; zip -> agenttesla,Attachment,2
4/12/2023,Outstanding invoice against B/l no MEDUV8024584; z -> agenttesla,Attachment,4
@silence-is-best
silence-is-best / gist:1cfdea76f35046443d537fa721ac2a2e
Created April 10, 2023 15:20
Mar 2023 Malspam Campaigns
Date,Details,Email Payload Type,Users Targeted
3/1/2023,Re: Invoice [Payment Advice US$27504]|???AW: Order Signed contract and PO; zip -> origin,Attachment,10
3/2/2023,Order Confirmation (P.O.) No.4036041334; zip -> agenttesla,Attachment,10
3/2/2023,PARTS INQUIRIES; r01 -> guloader,Attachment,2
3/3/2023,RE: Payment; rar -> snake,Attachment,2
3/3/2023,Wrong Payment Details; z -> agenttesla,Attachment,3
3/7/2023,T.HALK BANKASI A.?. 08.03.2023 Hesap Ekstresi; zip ->,Attachment,2
3/7/2023,Re: **TOP URGENT** Shipping Documents; rar -> snake,Attachment,2
3/8/2023,Proof Of Payment Completed Today!; rar -> formbook,Attachment,23
3/8/2023,Re: ISF FORM - THPAL - 4000004312 / URGENT; zip -> agenttesla,Attachment,3
@silence-is-best
silence-is-best / gist:17ede2b814928600571bec473d59c56f
Created March 1, 2023 18:28
Feb 2023 Malspam Campaigns
Date,Details,Payload Type,Users Targeted
2/1/2023,Statement Of Account; r11 -> origin,Attachment,5
2/1/2023,RE:RE:PAYMENT TRANSFER AZ34009 INVOICE; zip -> luminosity,Attachment,2
2/2/2023,Re: Invoice # 9776 from H & D; ace -> formbook,Attachment,4
2/2/2023,RE: SHIPPING DOCUMENT & PACKING LIST; r15 -> agenttesla,Attachment,2
2/2/2023,FWD: Payment Advice - Advice; doc -> lokibot,Attachment,5
2/3/2023,RE: MOQ-10356-507; xlsm -> snakekeylogger continued to 2/6,Attachment,23
2/3/2023,RFQ: ORDER-T2190-CVE97; z -> origin continued to ,Attachment,4
2/3/2023,Purchase Order WAR002 511; rar -> agenttesla,Attachment,3
2/3/2023,How can i contact you?; one -> dll -> icedid,Attachment,2
@silence-is-best
silence-is-best / gist:155e5c3c05b89f201211a2ceff955c60
Created February 2, 2023 15:35
Jan 2023 Malspam Campaigns
Date,Details,Email Payload Type,Users Targeted
1/3/2023,ENQUIRY SO NO - 270; zip -> formbook,Attachment,15
1/3/2023,Re: Fwd: PO EFT; img -> hta -> agenttesla,Attachment,2
1/5/2023,Taxes; zip -> hta -> xworm,Attachment,3
1/8/2023,RE:BL DRAFT SO# GOSUSNH1637860; zip -> formbook,Attachment,3
1/8/2023,Payment Advice-BCS_ECS9522022121320540019_16334_952; doc -> agenttesla,Attachment,2
1/9/2023,SHIPPING DOC (CI,COO,PL,BL); zip -> formbook,Attachment,3
1/11/2023,Re: PO January Invoice_(Payment Confirmation); rar -> hta -> agenttesla,Attachment,2
1/11/2023,RE: Purchase Order 8391-6; doc -> netwire,Attachment,3
1/11/2023,Re: Fwd: PO_Invoice-Copy; rar -> hta -> agenttesla,Attachment,2