주간 피싱 이메일 유포 사례 (2024/08/18~2024/08/24)
본 포스팅에서는 2024년 08월 18일부터 08월 24일까지 한 주간 확인된 피싱 이메일 공격의 유포 사례 정보(이메일 제목, 첨부파일, URL) 를 제공한다. 가짜 로그인 페이지 유형(FakePage)과 악성코드 유형(정보유출, 다운로더, 취약점, 백도어등)을 구분하여 소개 한다. 유포 사례에서 다루는 피싱 이메일은 첨부파일이 있는 이메일만을 대상으로 한다. 이메일 제목과 첨부파일 명에 등장하는 숫자는 일반적으로 고유 ID 값으로서, 이메일 수신자에 따라 다를 수 있다.
가짜 로그인 페이지(FakePage)
| 이메일 제목 | 첨부 파일명 |
| 배송 AWB 및 송장 문서 | awb_doc#221.shtml |
| 배송 알림 | DHL DOCUMENT.html |
| 전자세금계산서(Y&S)->회계법인***) 새창에서 읽기 | NTs_eTaxinvoice.htm |
| 첨부도면 견적요청 드립니다.(***** 입니다.) | List of quotation items.shtml |
| 화물도착통지 ~ 14PCS Gross.Weight 185.60 KG ~ ICN (인천) Inbound Delivery | Cargo~수입서류(청구서).html |
| 화물도착통지 ~ 4 CTNS G.W 180.60 KG ~ ICN (인천) Inbound Delivery | 사급업체 납품건-Cargo Waybill(2).html |
| $64.342s are now reflected in your account. | Your_account_already_has_19,746$-6983.pdf |
| [ANTSTUDIO.CO.KR] AFCI_CPGBrokers_August 21, 2024_2024_Distribution__Notice_037093_Final.pdf with you | ANTSTUDIO.CO.KR_SKM_C590368369060_417161.pdf.pdf |
| [DHL KOREA] 관세 납부 안내 | DHL DOCUMENT.htm |
| 【전자 영수증】받은 새 전자 영수증[영수증 번호: 23442000000336889191] | NTS_eTaxInvoice.html |
| Admission Inquiry for My Kids | Addmission inquirt pdf.shtml |
| ATTEND: PERINTAH PENGADILAN RESMI | Konteks Hukum.pdf |
| Confirm Tracking And Shipment Details | DHL#DOCUMENT.html |
| DHL 1113734508 (SZ NETELEMENT CHEMICAL CO LTD) – 화물도착(예정)안내 | AWB # – 777724023199.html |
| DHL Express Shipment Arrival Notification For ch*****@******.biz | DHL SHIPPING DOCUMENT.html |
| DHL 관세 납부 안내 | inv doc.shtml |
| EMS 发货通知 21 Aug 2024 | EMS_Shipping Doc0053894.html |
| Fedex 관세 납부 안내(Tax Invoice) | awb_packing list.shtml |
| From (REMOTE ID:5481853838) Inbound FAX-Delivery For changh*******@****com | ***.com_FAX MSG-963-XXXX.htm |
| Hotel Reservation Booking | Woodway llc Reservation pdf.shtml |
| New Chemical Quotation | NEW QUOTATION.pdf.html |
| Purchase Order | Adobe-xlsx.shtml |
| Re: Admission Inquiry for My Children | Addmission inquirt pdf.shtml |
| RE: Contact Agreement – Updated Invoice 002UZK-24 – PO: UZKR0001 | Payment slip.htm |
| RE: DOCUMENT INVOICES | invoice balance.html |
| Re: Quotation for spare tools machandise. | 170-Order.xlxs.html |
| Re: Revise Invoice to Euro Currency | Invoice-5123446 pdf.shtml |
| Re: Samples | Sample002.pdf |
| Remittance Advice sent On: 19 August 2024 | Remittance Advice PDF.shtml |
| Report Ready for Your Review Ref-5cc65e4145337d102e073fbe83b286d6 | ***.com-Receiptd48d69ecc7174567b00611334908285ee1181dce.htm |
| RFQ #9300186_Saudi Khaisung Innovase Enterprise Order | RFQ #9300186_Saudi Khaisung Innovase Enterprise Order.shtml |
| Shipment Document Arrival Notice urgent! | Original BL CI Copies.shtml |
| WoodWay llc Reservation | Woodway llc Reservation pdf.shtml |
| Your document is ready via QR Code | 345467DOCUMET546786.pdf |
악성코드(Infostealer, Downloader 등)
| 이메일 제목 | 첨부 파일명 |
| [MPO] G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715 | G_24370-.tar |
| [URGENT] BANK INFORMATION ERROR/CONFIRMATION | Bankdeta.rar |
| AR statement as of 07/04/2024 | SOAJULY2.zip |
| Business Inquiry from New Zeland | ORDERCON.vbs |
| Contract_/_عقد_العمل | MB2678836265AE.bz |
| Debit note from JAN.2024 to JUL 2024 | Debitnot.zip |
| DHL Shipment Notification : 6060781930 | DHLShipm.tar |
| Documents | waybill_.7z |
| EPDA ENQUIRY: MV TBN — DISCHARGING STEEL PRODUCTS (25, 000MT WIRE RODS and 30, 000MT STEEL BILLETS) | TBN – VSL’S PARTICULARS.xlsx.lzh |
| Fw: Balance payment confirmation | paymentc.rar |
| Fw: Fwd: Fwd: 00761 4.25 BUY | NewOrder.zip |
| Fwd: RE: RFQ AUGUST-2024 | INV-RFQ082010240023.xla |
| GT VICTORY V.14/24 // CALLING PORT FOR DISCHARGING ABT 20KT PARAXYLENE // EPDA ENQUIRY | Q88_GT VICTORY V.14.docx.lzh |
| M.v Lowlands Kami /DP/ EPDA inquiry For discharging 56670mts of Metallurgical Grade Bauxite and 22550mts of iron ore | SHIP PARTICULARS.pdf.lzh |
| M.V. ASHICO SYMPHONY // AGENCY APPOINTMENT FOR LOADING 15380 MT. RICE IN BAGS. | ASHICO SYMPHONY SHIP PARTICULARS.pdf.lzh |
| MT NAXOS / VOY 8 / FUEL OIL / Discharge / Agency Appointment | Q88(Oil)_MT NAXOS 20240820.docx.lzh |
| MT ROLIN// AGENCY APPOINTMENT | Rolin_Q88 V6 (Oil)_19Aug2024.docx.lzh |
| MV AQUAVITA AIM – Dischg Soy beans at Port- Agency Appointment | AQUAVITA AIM – VSL’s PARTICULARS.docx.lzh |
| MV KAI RUI/discharging 68,000+mt barley at the port/PDA ENQUERY | MV KAI RUI – TC PARTICULARS.docx.lzh |
| MV ROYAL KALEIDO / NOTICE OF READINESS RE-TENDER | NOR.IMG |
| NEW ORDER PO 40192 | New Order 51092638400.zip |
| New order QE-2403KBR4 | Neworder.zip |
| order For 2nd Quater 2024 | rfq_commercial_order_GMlist_for_Drumedis_tender_august_quater_2024.xls |
| Original BL, CI & PL | awb_dhl_.7z |
| Payment Advice – Advice Ref:[A2aTjBLLC1Xm-IN] / Priority payment / Customer Ref:[8200205821H24] | FTT37893.7z |
| Payment advice-BFTI-EFT7602024080106050037_220824 | PA BFTI-EFT7602024080106050037_220824.xla |
| PAYMENT CONFIRMATION | PAYMENT CONFIRMATION.zip |
| Payment Notification | 2dPWKtwd.lzh |
| Potwierdzenie Płatności i Status Zamówienia | POTWIERDZENIE PRZELEWU_35 000 EUR.7z |
| Pre-production Samples | IMG_INVENTORY_LIST.7z |
| Project order August 2024 | rfq_commercial_order_GMlist_for_Drumedis_tender_august_quater_202400000(991KB).7z |
| Purchase Inquiry | Purchase Inquiry.xla |
| Purchase Order /APO-074787648 | Purchase Order APO-074787648.zip |
| PURCHASE ORDER REQUEST | PURCHASE.xla |
| PUURCHASE INQUIRY | NEWPORDE.TAR |
| Re :Payment of Invoices -Request Receipt | Inv No.248768.xls |
| RE: [JWGS] JW-AZ STATEMENT JULY 2024 | JWGSJW-A.rar |
| Re: AIR SHIPMENT 988-0275 2993 / | shipping.rar |
| Re: DHL Shipping Documents for customs | invoicea.zip |
| Re: DHL Shipping Notification 9407155789 | DHL94071.zip |
| RE: mail inquiry | inquiry.rar |
| Re: PO202407050069 (155668) | shipping.rar |
| Re: PO202408030008-METALS MANAGEMENT PTE LTD | PO202408.zip |
| Re: Re: RE: INQUIRY#46789-AUGUST20 | RFQ#TLPO.xla |
| Re: Samples | Sample 001.vbs |
| RE: test mail inquiry | Listofpr.7Z |
| RE:__Notificação_de_envio_DHL_9407155789 | DHL94071.zip |
| RE:_回复:_PO-REG_8_cases_PO#_-_SPG-18384789,_SPG-18384789,_SPG_1838470_ | Scan_Rev.r00 |
| Request for Supply of Materials | TFisherRFQ1908.img |
| SHUNYUE18 V2410 FOR DISCHARGE ABT 13000CBM LOG / AGENCY APPOINTMENT | sy18 ship’s particular.lzh |
| Signature for your Benefit reward | Benefit_Signature#0224.tbz |
| Thermo Fisher RFQ_TFS-1507 | Thermo Fisher RFQ_TFS-1507.xls |
| Ulsan/Yosu Port Restriction & PDA to load 18kt of CSS | VESSEL’S PARTICULARS.pdf.lzh |
| Urgent Request for Proforma Invoice | IMG_TRIALORDER_OTHERS.7z |
| Your Transport Plan has Changed – Maersk | Transport Plan.img |
| ΕΠΙΒΕΒΑΙΩΣΗ ΝΕΑΣ ΠΑΡΑΓΓΕΛΙΑΣ | e453724f-66c1-11ef-8c90-44a842253044.obj |
| 附上付款凭证 | 8737738_19082024.7z |
하기 IOC상 MD5는 이메일에 첨부된 피싱 페이지 및 악성코드의 MD5 해쉬이며, URL은 피싱 페이지를 통해 사용자 계정 정보가 유출되는 C2 정보이다.
013bd67b1574c57b65ad508828713bf1
046124416e5be2fcb0de538ef4843373
063459259873463e6b80b2290a446565
082f76b7f4d91a0cf6e4f83af01df3ec
0ffb7c770643415162ae8f641b0038be
https[:]//abvinvest[.]eu/ems/send[.]php
https[:]//bullchraister[.]com/SmWjr3M/feedback[.]php
https[:]//contact[.]deegree[.]shop/l[.]php?comms=
https[:]//instelnet[.]pe/jir/data[.]php
https[:]//molnarpeterepitesz[.]hu/wp-includes/db987/IMG02314583
AhnLab TIP를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다. 자세한 내용은 아래 배너를 클릭하여 확인해보세요.
