February Malspam Campaigns

gistfile1.txt

Date,Details,Payload Type,Users Targeted
2/4/2025,Request for Quotation; docx -> xloader,Attachment,4
2/4/2025,RE: RE: RE: RE: A PROFORMA INVOICE REQUEST FOR YOUR TODAY'S IMMEDIATE PAYMENT !!!; zip -> xloader,Attachment,6
2/6/2025,OC4503585788; 7z -> originlogger,Attachment,4
2/6/2025,RE: TNT Express //Arrival Notice // AWB #8013580 2/06/2025; zip -> snakekeylogger,Attachment,2
2/7/2025,RE: T/T EUR 78845.10; doc -> snakekeylogger,Attachment,5
2/10/2025,Re: GPRI PO #24090838; docx -> -> rtf -> xloader,Attachment,2
2/12/2025,PAGOS|INFORME MODELO 347; rar|tar -> snakeykeylogger,Attachment,4
2/12/2025,Purchase Order #PO240145|New Order PO240145; lzh -> xloader continued to 2/14,Attachment,8
2/13/2025,Orden de compra; 001 -> originlogger,Attachment,3
2/13/2025,FEB Purchase Order; lzh -> xloader,Attachment,2
2/14/2025,COMPROBANTE DE PAGO; rar -> originlogger,Attachment,3
2/16/2025,PO#CHISHUN/17.02.2025/QM- URGENTLY!!!; docx -> xloader,Attachment,2
2/19/2025,New PO 127429; rar -> snakekeylogger,Attachment,4
2/19/2025,Re: payment request 【紧急付款请求】; z -> vipkeylogger,Attachment,4
2/20/2025,Wire Transfer Completed – Chase Bank– Ref #TFR-CHS-117456206; rar -> njrat,Attachment,18
2/20/2025,RE: Invoice for payment; rar -> originlogger,Attachment,4
2/24/2025,invio Ordine di materiale n. 57 del 23/02/2025; z -> xloader,Attachment,2
2/24/2025,Your invoice copy|Payment invoice.; (library-ms) xml ->  asyncrat,Attachment,41
2/24/2025,RE: Final Shipping Documents; rar -> originlogger,Attachment,4
2/26/2025,ACH Order Receipt - 0225/25- 00315843000 - | 25/02/2025 05:06; lha -> vbe -> darkcloud,Attachment,2
2/27/2025,"RE: Request for Quotation|RE: SHIPPING DOC (CI,COO,PL,BL); rar -> xloader",Attachment,11

darkcloud, 42010baf216de2a0dad639aeda6b6de0bf5cd172045a69e790eb14c297091117, https://api.telegram.org/bot7684022823
darkcloud, 67d6cdcfa5fce9c520a2a110ef28821556f3814f54ec0c28842b0e451928d7b0, [email protected]
darkcloud, 79f7e76ba3a8780a2dd46d78aac07f2235f457ee2771ef4556b85c12f2be0061, https://api.telegram.org/bot8171626722
darkcloud, 806d68af9c97c30383ce384016eb5f985de9e3b00b0982e3900cac488d58ba3d, juguly.shop
guloader-originlogger, a3fef5ee73b817bbe33c275f8c08e309608f2feed6b5b8a2b0e6aa076c42823e, mail.osmahab.com
guloader-vipkeylogger, f1b6f735c651a28ecb97d4b9e21adc5d79ebed5b2686482f58ae33df3f13492d, https://api.telegram.org/bot7618867847
njrat, 83f196de27b44807a2c4697ebe19b7995971e7dbf6d09a9dbc0c91076b47a6a1, 198.46.177.152:1177
originlogger, 0a8fa6bd294e356d9e856610259c14894ed1ad4d8238efb191d61a7a08f74045, [email protected]
originlogger, 721490f6523a38a63d64f8d266f32be5cd9f4140f1bb2577fa7b579b105ac37d, ftp://ftp.stingatoareincendii.ro
originlogger, 8af2031c4745713568d61010c97583fed974129f613ff5f2285ea5e294fa5311, https://api.telegram.org/bot5656780330
originlogger, 95687da203507a11837eaeb29bfe86481828b74b62fc869604b5eaa552f950c2, https://api.telegram.org/bot6407543017
originlogger, f11a80123a901473bc7a5dabdd51847e6adbda96280dec8442fd2ef96cce42af, ftp://ftp.stingatoareincendii.ro
originlogger, fb4d247c79061e234d6659921626249598990adb9d0c7c1109a029812cbeaea5, mail.osmahab.com
originlogger, fe0c0a5da033e86e09a721070bb2e1116a28160aaffd803b8e65a57ed25e62c1, https://api.telegram.org/bot7220431026
purestealer, 7a8193cd0c27f0e58e18e9cbca9928ad9ed89adcec924fc77c2fcdcf52a7c014, 176.65.142.176:8039
remcos, 5d695d8a0bb1d919cc77a2aa2488a61797bfa065238160278ee458120630aaf9, 188.127.225.33:5637
snakekeylogger, 05b9251ba66b0a705b346c115556e8c90a449fd85b8e1c26e822dfdde3840ef6, https://api.telegram.org/bot5227573794
snakekeylogger, 065e791b073f639eab59ad7dcf1e61f18c757da7da7964b017a1ed649eec8259, https://api.telegram.org/bot7570158401
snakekeylogger, 1a0b8d6588e7cc1f5c0d7e7cce3ede026e94059a5599b86a8ce43ececc481ebe, gator3220.hostgator.com
snakekeylogger, 2a1b2e65014eff8d6898cb69bdbfd860aa7a71092b87c744dffb4c0620865a51, hosting2.ro.hostsailor.com
snakekeylogger, 2c334c372ef9c7114ab35d3e6f1a47d8617ba42a6997f3515423635f5f06bc08, https://api.telegram.org/bot5227573794
snakekeylogger, 2f1d9da7f9382f2a8e97474d0ee540abede94da80051b831e6b926126ea9ce40, https://api.telegram.org/bot8152393919
snakekeylogger, 36d1c3097e2cf1d4859d9c1145fe80d1329d8785696326ce62b2196c41b9e97c, https://api.telegram.org/bot8152393919
snakekeylogger, 4b73e2b3216c57d323bd8d9a70df985072b0d6c20e4ebdc3f5e9e7e6a9c750b7, mail.aktagor-prom.by
snakekeylogger, 4f16a03cb10c985843a3c9c6a205cc599bf062ce48a1213b0e86ba8681290877, https://api.telegram.org/bot5556423198
snakekeylogger, 5506ebabade03d207298faa36294ed5909c608640593d2cfae39aa7a7213bc45, https://api.telegram.org/bot7758743786
snakekeylogger, 5ebabe256996109627a7e24b46bcc983f4a4cfac84202f8c5d9dcbd3c81c644d, gator3220.hostgator.com
snakekeylogger, 6c9bfc38f2dd0b8e0ff1ae18e0286fd13cc7f27dfadace3a6663ae53ef3c1ed0, https://api.telegram.org/bot7905871292
snakekeylogger, 855a8e1b2eae2c60b48ea30b9d34a4a5fc1a65385207125f37419c06c0575d40, https://api.telegram.org/bot7950213468
snakekeylogger, 9563e215a0e8347722a008f6b0797078d8096d73607708aaeaac51b3736469bb, https://api.telegram.org/bot7758743786
snakekeylogger, af3d613e5a1324a46220bdc59879ce5eedf190351664dd9cc81b308f98c3f208, https://api.telegram.org/bot7347885220
snakekeylogger, aff2d8ebd4a9c0218b8df1314b12fd2dec7706b7f1cea2029c663c53e52ff187, https://api.telegram.org/bot7570158401
snakekeylogger, b6da93489b265943cd505e8908005bf8e9eab517b8f6a34b69f48abd017ebc9e, https://api.telegram.org/bot7745751910
snakekeylogger, da5672185bdcb791e426127091bc7da56812d6c6cba9fc6aca754e43b59834db, https://api.telegram.org/bot7570158401
snakekeylogger, e5061b1f5a47cd5d0d30fd7c306ed51799a1f7f6ef995f3895df707ea2976474, https://api.telegram.org/bot7595753943
snakekeylogger, e78cc38d7fecde61d43d6a18d96b0ca35f56e89a4b0008d5551e7beb30591650, gator3220.hostgator.com
snakekeylogger, faa8850d8a28a308c917200981a80bcc481cb089f804f6867a4608a28bf0b2b5, https://api.telegram.org/bot7891452286
venomrat, ad4cd780bd7accd7482dcf6222910aafee971c7ab870ebae0022d51b237fa5cb, 176.65.142.172:4449
vipkeylogger, 00bfb361f9256881a9d058ceec927aab24198bd1ddea3bd8b1529edaefbc1c89, mail.vvtrade.vn
vipkeylogger, 063da58edb72802cf74c1c113fe4107ede937b346b066356158d38724d13c1c8, us2.smtp.mailhostbox.com
vipkeylogger, 0b56d8b3ffd39f5ee4a0af61b329700051e38c019a722e74efc197b18602f69f, https://api.telegram.org/bot7552206830
vipkeylogger, 1a8dd4fa9763e441591d8d927e8f69dc9e5138c62c80c9ff8d5007a1b8b2bef0, us2.smtp.mailhostbox.com
vipkeylogger, d313827b50a344b6f5a1adb8392a5be95d65e07d0c58b2e3b91524b33caf5139, mail.jhxkgroup.online
vipkeylogger, d38b46579ea8db2c90865037a8756401bbb18a41dd1fb494b3f18d98299cf88e, https://api.telegram.org/bot8043603189
xloader, 003e445ec7e3a973ac6b61b8375e4db13e9ac69a2fb48f3c647571c473eb22c2, subur88wap.sbs/3nop
xloader, 0297c69a6525dcc36009ebcf3df69478f22e99d788dd81b1a26728c7acb663e9, cicotte.shop/my18
xloader, 04b3e24898ad118dfee0013ae96979d83d0dc99c3497fd123b09d3cbf9180cbb, cicotte.shop/my18
xloader, 0a0369a61c8dc0a7993d213768939cdf23eaeb8549b96790ed01bd90f04c4219, www.gameo.info/w62v
xloader, 124913063a6d7969f322f06d50366c21c7f3960ec25f8188af84513f4f4fbf42, http://www.gariano.info/p9gz/
xloader, 1a0c0bf6760f3967f8c77ba920c041e3a653821c70759e2913652219ad557520, cicotte.shop/my18
xloader, 2c29ea93f968d505277e277b5ba7c88a44b14436e160cc0a36d575d669c51575, www.sofiaagibson.xyz/6fbu
xloader, 2ff94bfc36adcaa2ae9e0a0bded07c026f9b4249bbdb744ca72b07713d41cd1e, www.safitri.shop/ymtz
xloader, 30af910477a154c4b07fa1cbb928f78bc7d714329f725b2a1f2cf7f3139ce351, eniorshousing05.shop/a01d
xloader, 36e9bfc5337aa8a4dd2c8c24087a3cdc3f589df01ec12c0d81a28eb62b67b9e4, cicotte.shop/my18
xloader, 441d4e2afda5dd4114f7ff1cde9d4c4722a187ebb2166a1047b9c1403bacf5a4, http://www.shibbets.xyz/r026/
xloader, 447fdc076abf331b88f87809ee194cd1c3634d0556339c9711d61adcdc2c01cf, http://www.plantgarden.xyz/cjrs
xloader, 45e3b1735df7c76cac0c02dab2bd084220687e4d9786ea6a32e8bca70dc1a4cd, http://www.us-urbanservices.net/ofh9/
xloader, 583301080b343f41fc8676a407e3892129834c1c6ae07fd47342e7c0077a224b, www.banjia0731.icu/z2tq
xloader, 5f80dbe0b909aa3bbf9fa7f841ddcad1687efdaaf31b7523dda11ab6c8a97d94, http://www.leadmagnetkpis.shop/pbr5/
xloader, 60ccea072df0c91b1b0f2cc18a88eff5e373c68f4d13c7d93e66fb17d211ec9e, coplus.market/a02d
xloader, 61dca33592107d6dee726d1d3a960507e32b0845c9e4e8c07c81e07096b0b670, ukv3.online/mg63
xloader, 637ec5277677d323a35dce85ac7fb3440ec70ca14fbaa051a2df46652a4711d4, eniorshousing05.shop/a01d
xloader, 682ea9386cf6916b93cd4d71b6e9a56766178c8479e9a5121ca42672d4680754, eniorshousing05.shop/a01d
xloader, 730f10ea6f19f62c826e980760a20ded9eccbf13c5595ecfcf989722dabb4b27, http://www.blogkart4u.xyz/wj75/
xloader, 78e8787616a4d7be2eb5c127e75e3326de2c3e2dbf2a2533163f9594c0214b16, nnovate.host/b02a
xloader, 79aa896551cd2738e5ff969ebf5e548fb5562f0f9238cdd6fe1f05a5fd89d4a7, http://www.blogkart4u.xyz/acpw
xloader, 7c7a37f2a806c0e0845d2605f3f39cd7d80637d8a59ff7d2fa6a9125dfb329ee, http://www.kasun.wtf/uctb
xloader, 81479585d4d134cc2bdfbbf5a3200a9ec5ca2d142020b53ea3302239c595b37a, http://www.nexave.live/g9oo/
xloader, 837b5c608ebc19191678d6cca32c6558e6ad3624015858ecc8c895766298a5b1, cicotte.shop/my18
xloader, 8d8bb9cc17e7e3bfda2630a37f1b8866fed36b43765ef579977684c7fcc6ee7b, http://www.vaishnavi.xyz/lfjm/
xloader, 8e06ed422edfc7904592e8c8cdacebd0ad5118c4b3dcb3daa404e8e4d97f6e5a, nnovate.host/b02a
xloader, 947ec6962a7ed9346d1c6b182a8c4fb3345845efe21d7e243314cfe7809f818b, cicotte.shop/my18
xloader, 979cecac7761f1c8cf74b514b38b637c15407b9def72c96814bec589a1d4618d, http://www.vibrantoul.life/pp15/
xloader, 9aa38b8cdbf5c14b63df00b2d842417396660e8e0767b3cc381fb3d4ce171c3c, cicotte.shop/my18
xloader, 9cc0de5de977708445e5ce017d6d5d97e00c7749e3a93e8308d493687163af21, www.tsd2.net/dqfl
xloader, a58b12ce627c7234261b7561b7f1e2bb82bdfa745a20db1259443a99e6f8c6fb, http://www.dynavision.website/ov9p/
xloader, a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e, eniorshousing05.shop/a01d
xloader, aa23282f21a7d640fe80b4911b633ab1e5c42258a3369b9c0286ff84dccec9d8, www.menekankan.xyz/wohk
xloader, ac381e891cda88d95c3402a58a256a52f1ff4e4fd0f4803f4d4ddd43691dd81f, www.j8g5rjpc.top/e8pd/
xloader, b2fe57ff7504883c1a5050ccf0a6cfe45087a43bea4ce92aec075be6f1852a29, eniorshousing05.shop/a01d
xloader, b51868a125a577733f6208c4f11c8887aca278b339abe7f62fe2a4808a8399aa, cicotte.shop/my18
xloader, b6e1a7be0cd6d15ce7ba0bc79da9b8f280ab0060bc7754ba3df84555fc28b0db, cicotte.shop/my18
xloader, bd0b43f9e5231b5a2619a06f1b012762cb4d6c3215281467ad95f5c822e0c66b, http://www.86536.pizza/k7of
xloader, be8bef17ae29e1e5c3fc07a4c27dd4a89ec744644aaa2900b0cd9cd9cc230f11, http://www.garfo.xyz/fanx
xloader, ca275788292983ccf5bee843aac527281ccb353aa802dcd4cb02472de9c6ce33, http://www.vintageprod.net/zimf/
xloader, cc3874f1aa9edb27fa3fd892a7bf53d80f93db85b97ec3b003d018a62d9a49d6, www.stellub.site/hp40
xloader, cc4a473cb0b7e331d6de4ce7ffb1b89f9fbd912bc87784b0f39e171b9866630a, www.kakeksakti43.cfd/37iq
xloader, d186b7a51985cf3d5104c5bb3d7b4d9aac71d974cf2ec465deef37777313bfce, http://www.nexstep.live/cix8/
xloader, d54150a3eeb53af87161003cf934bb4ca1fe42bbc92d6d957241bfcdb8538797, acha88.info/se01
xloader, d672848afdf3f3a32d6de454a3408acd1d9cc0c338e65461e63330e9d26128ab, nfluencer-marketing-13524.bond/a03d
xloader, d853825ca0a839c07cb0b00a5d2a418058fa2ba649cce517ed569a566f205ca2, cicotte.shop/my18
xloader, e3d098c75b7d9ac2bcc0a77d244775131d0993d46145621e4b1dd40f2023fded, www.themutznuts.xyz/d6sm/
xloader, e9a1f5e4de3dfdf6cbd66863a6fa6a638cce8fa9555991756820b5af48682c79, nnovate.host/b02a
xloader, ed7785a15786fe6af38b6b00f33461dc30f4bf755f7cc6e2a727db2b02f2e9a5, http://www.blogkart4u.xyz/acpw/
xloader, f083c69e9070bb7d48eac9f06da6503a9f47829536bfa94065be7385f12ce07c, cicotte.shop/my18
xloader, fab2b2eddd748ae7fcbc5a1d0c2e0a7f9c75214a114d9450ca41c85ea9e71a09, http://www.haoyun.website/a03d/

[email protected]
[email protected]
[email protected]
[email protected]