주간 피싱 이메일 유포 사례 (2024/06/30~2024/07/06)
본 포스팅에서는 2024년 06월 30일부터 07월 06일까지 한 주간 확인된 피싱 이메일 공격의 유포 사례 정보(이메일 제목, 첨부파일, URL) 를 제공한다. 가짜 로그인 페이지 유형(FakePage)과 악성코드 유형(정보유출, 다운로더, 취약점, 백도어등)을 구분하여 소개 한다. 유포 사례에서 다루는 피싱 이메일은 첨부파일이 있는 이메일만을 대상으로 한다. 이메일 제목과 첨부파일 명에 등장하는 숫자는 일반적으로 고유 ID 값으로서, 이메일 수신자에 따라 다를 수 있다.
가짜 로그인 페이지(FakePage)
|
이메일 제목 |
첨부파일 |
MD5(첨부파일) |
| 배송 문서 확인 | Invoice + AWB.html | eabf74dd0987e3fc5cea299b7029e3c1 |
| 주문 확인 – P.O 465 | 스위프트-TT.pdf.html | 7ce4c0bc0908932ed1e553851cad0893 |
| 수입 관세 정보 송장 | AWB#276097479258.pdf.html | b6f3174e246a3c8951d959712c821eda |
| 안녕하세요/AWB | AWB_INV document.Htm | b143ca8c9587211ca4ada4a5f862647a |
| 배송 도착 정보 | awb.shtml | 6d4d99eb2a676eb6d3a9cefe43511ac8 |
| FedEx발송물 도착 알림 | AWB#989345874598.html | b227fb7aba202d090b5b4cf6a0f6e0df |
| 보류 중인 메시지 검토 및 복구******@******.com | *****보고서 .html | e22a9bfdb7c78ade860e5d250c216d24 |
| 배송 AWB 및 송장 문서 | awb_doc_pdf.html | 93589cd4e99bb5c1e8d07f9f7479dc9e |
| 사서함 격리 | Samchully보고서 .html | c59fc5c60994d5d2dff04354103072f3 |
| ⚠️ URGENT, Please Confirm – Email Restriction | *****.com.Shtml | 7f258065f354a4dd8701cb813ec30d5c |
| Fw: payment remittance | receipt_pdf.htm | 08123214b342c1cf890070d902774c01 |
| ETF Swift from Chase Friday, July 5, 2024 | chase_wire24#.pdf..html | 9743004aa54072627a2c45b49b37027a |
| Pay Notice Status Processed Completed | Funds Transfer.pdf | 423d2871a4dd99064918732dbca46e18 |
| Final payment for invoice 3 Jul 2024 | EFTRemittance.shtml | 0d00503869aee86d014089c4dd03f218 |
| Final payment for invoice 4 Jul 2024 | EFTRemittance.shtml | 3d701f4f7809c3b2de24918ee591611e |
| Re:Re: New Order | Ref #PDF46378294.html | 79ef48c52bfda823db2a8cfa59daef0c |
| Business Invitation | Business Card .html | e545d17d79ee73c2109d213e5764b4f0 |
| Fwd: PAYMENT-S-1219-23A INVOICE & BL | INVOICE_BL-TFA903874777839.Xlxs.Html | 93ebf08293912f31ed955b64a0d87cad |
| You received Contract from DocuSign Service | DocuSign- Contract.html | 125d37969541d96879d7ddc9964975ac |
| FW: Shipping Document Notice | Shipping Document- INV+PL.PDF.htm | 11e0b592a1131b49378c822029666d47 |
| Urgent:Re:Re: Request For Invoice | Purchase Order #46378294.html | 56823cbc16c1f168184d6f919a27934f |
| Benefits Enrollment Form | Ant Studio Open Benefits Enrollment.pdf | 4db4c46b8dd2cfbd59bce53842c7fe10 |
| Facturacion. No Pagada (Segundo Aviso) | Factura_555061.pdf | 493e5ab8fdedeb2db0ce87032bb92acb |
| Aviso de Pago – Aviso Ref: [G41978847387] / $ 17.174,00 / | Ae-01922WPO-24.html | d96a32b947d12a7a928179dc9ac3913e |
| Payment Receipt Confirmation – 1400126265 – 1301932048 | Wire0839380292.html | 7df406d95bbcb016b552c92349c5c0e8 |
| DHL AWB Arrival Notice #310479442 | AirWaybill_Document.shtml | 37778a532a8bc09c833a98e89b7263df |
| Re:Re SWIFT_USD.62,529.45 | Swift Remittance_USD.62529.45.Shtml | 4e55b4240b5120a47ebf4761839cafab |
| DHL Order: PI#963421 – mschoi | Invoice + AWB.html | 7c79aa93c08119a2ed7b1e57396a7ee6 |
| FedEx Express AWB#******032750 – Information is required. | FedEx Shipping Document.shtml | a23bda81672b991b4b0872f2c585f967 |
| [********.COM] AFCI_CPGBrokers_July 02, 2024_2024_Distribution__Notice_975245_Final.pdf with you | ********.COM_SKM_C590368369060_417161.pdf.pdf | 92193a557a78cf0d712b1b18ccb6f227 |
| Final payment for invoice 2 Jul 2024 | EFTRemittance.shtml | 03e45be232e4c760b171f5f2d73d2b07 |
| DHL Order: PI#963421 – swlee | Invoice + AWB.html | a92d859386e9656e749fa4a73d8e75e4 |
| FW: Re: Signed OTL Equipments Invoice for hyundairb.com | PO#STR6194.PDF.shtml | 48e8bec0d452b79eb53df875a941fe94 |
| Cargo Arrival Information. | Invoice + AWB1342.html | 96dfe00a5cbe3bbf4f63ffce3df799ac |
| DHL Order: PI#963421 – gjmdrg | Invoice + AWB.html | fdb557d8f4a5e3e50c10fe1d6bf3be9c |
| 艾沃： Request for Proforma Invoice | Purchase Order- B23041GTM For *****@****.org .shtml | 9df9aeb61d82b068b178b8718a46a1a4 |
| Refreshed Compensation Details #W53I14 | 28_Salary-June_FT8777.pdf | bc6c291297300ab84ef869ddb7b7f91f |
| SF Express Monthly Invoice Notification | SFbill20887801011-2024.pdf.html | e675f5cc5438ed796f824d615d8dc8ea |
| DHL Order: PI#963421 – jskim4883 | Invoice + AWB.html | 55d89bc263cacd2b2a9f42bb79091d60 |
악성코드(Infostealer, Downloader 등)
|
이메일 제목 |
첨부파일 |
MD5(첨부파일) |
| RE: M/V”XIN CHUN”-CALL PORT TO DISCHARGE BULK BAUXITE ABT 180, 000MT / EPDA REQUEST | *** ****- SHIP’S PARTICULARS.xlsx.lzh | 213aae0e127c8e0052d764ea309a6f50 |
| Processed: Outstanding payment – 01-07-2024 | Payment Copy.rar | 98016b4c57fc38530cc0586ed0782b09 |
| Your Latest Shipping Invoice | Shipping_Invoices_Awb_pdf_00000000000000000000.7z | 69bb136615cb72855e237ab5755f7257 |
| New Sale Contract | New Sale Contract Ref0948949.rar | f0c74f82bf8d4709491393b6f7b29fa3 |
| INQUIRY_ORDER-06-16-27-TENDER | RFQ#ORDER-06-16-27-TENDER.tbz | d5f946ca6246cebb930a50d7ab39348f |
| [NOTICE] shipping invoice | AWB_DHL_Bill_of_lading_291098829T_28_06_2024_000000_pdf.7z | 390112d76dc2b8ef98de61363c2bd2ea |
| ***********.com WARNING: Email Server Blocked Incoming Messages. | ATTACHED COPY..docx | 10c774db881a877ea4c25b62d754b77a |
| RICHIESTA D’OFFERTA | 0097-CGM CIGIEMME S.p.A.tar | a1dee348cae0e72e34756c1af67a1ee3 |
| Invoice Paid in Full | Payment_Information_842.zip | 36121a06f7d94bd1c18f5ff4618d5f29 |
| Your latest DHL invoice : VTER000105453 for account : 572007948 | DHL Invoice 20240407.xls | 79e52f217cb627b3060d329050f9a1c6 |
| Rv:_Solicitud_de_cotizaciòn | lista de cotizaciones.lzh | 97035b40d01dc148b3b8491d227ce306 |
| PTFE Coated Butterfly Valve Picture — Lucky | PTFE Coated Butterfly Valve Picture.zip | 33bc360990c66beea144ae48d17504a6 |
| This is MT Solution Ltd. I would like to request a quote. | MT Solution Sales Inquiry.html | 985bf0a294bf71f544be80c1ba2395f5 |
| MT VLCC TBA// // DISCHARGING ABT 270,000 MT CRUDE OIL // CARGO PDA REQUEST | VLCC TBA – VESSEL’S DESC.docx.lzh | 213aae0e127c8e0052d764ea309a6f50 |
| NAHLA DRUG & MEDICAL EQUIPMENT STORE L.L.C//PAYMENT REQUEST//SOA | STATEMENT OF ACCOUNT.rar | 9f1c718f2f4499d91ac53fe6bd7d420b |
| MV SKYFUSION TBN – PDA & PORT INFORMATION FOR DISCHARGING ABT 59, 000MT OF COAL IN BULK | SKYFUSION TBN – SHIP’S PARTICULARS.docx.lzh | 56e47e0129e272ba1eff88e5534f158e |
| Purchase Order July | Order_000009383483734.img | 9a9ab628780efc567b60e686e34e4113 |
| Quotation #Q1397225 | Quotation #Q1397225.html | bb7dd67f59ce24d92d79be24c6f6c088 |
| upit UPIT 457525 | 457525.xls | d9a25c9909bc237a7c994feca9949340 |
| RE: Urgent New Order | 20240704-455.gz | 1d50f0c1ff48a16efb655a30addb121e |
| Re: AW: INVOICE NO.RY158243 & RY21NJ0567 | PO-S-1219-23A PL&IV.png.htm | 406cd97ceb892efca8655d3a3b935f87 |
| Re: Re: RE: INQUIRY#809676-JULY1 | INQUIRY#809676-JULY1.xla | 9c6bc8e919fa33f986bf28630ac5ebd8 |
| FW: Swift | PaymentAdvice240307.docx | 3a8f8feafa10789c76f5807f1db77579 |
| Connector request: YGC1176-EV-P (2+2) P Series | PO450000.7z | 399384b3d1480c948aee526d84320eb5 |
| DHL AWB – COMMERCIAL INVOICE, BILL OF LADING | DHLAWB#5.gz | 1aa2b5d372acff136682244845f1e7e5 |
| DHL Awb – SHIPPING NOTIFICATION | DHLAWB-I.IMG | 6a8d426b602c62ff313a431b6f026b6b |
| Fw: Payment Advice | Payment_.img | fa04bd14fa1c16454207d4d3baeb48e4 |
| FW: REQUEST FOR QUOTATION | IAS REF # IAS-3338 | IasTrade.7z | 5467a10a6cf39686fc6ea70a95d1b46b |
| Fwd: PAYMENTS (50% of order value) | swiftcop.gz | 6a8d426b602c62ff313a431b6f026b6b |
| Invoice – 951918794 | Invoice9.z | 7176db0616a015ca831d781b8e1118f3 |
| October Order – 2698 – FVG2-20240704 | FVG2-202.zip | bb89424cad7afd79723fa545f2fad1fa |
| ORIGINAL BL/INVOICE (Shipment Arrival Notice)Maersk | BLINVOIC.gz | c75228273936006223c0dd9843daf20f |
| PAYMENT ADVICE – INVOICE APG220701B | PAYMENTA.7z | 155548da3320bdc78f53c1268dfad2fe |
| Payment For Shipment | PaymentR.img | be22f5744c11b848504d44c9c9ba4ff8 |
| Payment Transfer | Invoice9.lz | 16c45088ae4b73695260779f45bd2e4d |
| Pre-advice of payment to your account | Remittan.7z | 386d935996dfb508b50390869967ea9e |
| Re: RE: INQUIRY#809676-JULY1 | INQUIRY#.xla | 7e1b4052d2483eea21ef214b8cb1337f |
| Re: RFQ | JULYORDE.IMG | f7f60ba4ae69911dd4e627a69b3e1d50 |
| RE: STM PO# PUO2023000545/AS>>>> RE: FW: RFQ/6681/RFI.025 | RFQ-MVAL.r01 | a36a92b6b97b2d9bbaced01015a366e2 |
| REQUEST FOR QUOTATION | RFQ65467.img | be22f5744c11b848504d44c9c9ba4ff8 |
| Required Tax Invoice for ET24251665 | Required.gz | 897fa3a11502e4243fae73e73c556314 |
| shipping Documents | awb_ship.7z | 13f93e87c36ff9332113e5ec904d78a6 |
| SHIPPING SCHEDULE + DELIVERY DOCUMENTS | DHLshipp.z | 6064af0fb1184367e836c63d1c3c5a42 |
| SOA JUNE 2024 | SOAJUNE2.zip | bb89424cad7afd79723fa545f2fad1fa |
| TT PAYMENT COPY #TRF20240703 | TTCOPY#T.gz | 27ddff902d78764b940467a4a55ab677 |
가짜 페이지(FakePage) C2 주소
hxxps://submit-form[.]com/LYUcPTlNS
hxxps://nocodeform[.]io/f/65b3a748ebfd5678a2950a23
hxxps://aerosch[.]com/hc[.]php
hxxps://yanushbrand[.]com[.]ua/0N85c/xle/processor1[.]php
hxxps://nocodeform[.]io/f/667ca7be77c737f310cfba34
hxxps://nocodeform[.]io/f/66868bd384d2bbcb979569c5
hxxps://submit-form[.]com/CHrPonEFp
hxxps://app[.]form2chat[.]io/f/fa425077
hxxps://oscropodium[.]cc/aMiosM/feedback[.]php
hxxps://nocodeform[.]io/f/6624e429315208634a3467f9
hxxps://nocodeform[.]io/f/66822a534da6c9c42d47b5db
hxxps://khoms222[.]ir/au/js/nike/sc/lognet[.]php
hxxps://submit-form[.]com/AY8TLeHt
hxxps://submit-form[.]com/QzSLHcLp1
0182fcde76face29601643d8a62556fc
01be045dfd5182f75ab1ffb103d3c8d6
03e45be232e4c760b171f5f2d73d2b07
061d3d8e84109fa2dcb470d1d35b640e
06e5b87d34fa0d7110fac0e5ce52cb7b
https[:]//aerosch[.]com/hc[.]php
https[:]//app[.]form2chat[.]io/f/fa425077
https[:]//khoms222[.]ir/au/js/nike/sc/lognet[.]php
https[:]//nocodeform[.]io/f/65b3a748ebfd5678a2950a23
https[:]//nocodeform[.]io/f/6624e429315208634a3467f9
