주간 피싱 이메일 유포 사례 (2024/08/25~2024/08/31)
본 포스팅에서는 2024년 08월 25일부터 08월 31일까지 한 주간 확인된 피싱 이메일 공격의 유포 사례 정보(이메일 제목, 첨부파일, URL) 를 제공한다. 가짜 로그인 페이지 유형(FakePage)과 악성코드 유형(정보유출, 다운로더, 취약점, 백도어등)을 구분하여 소개 한다. 유포 사례에서 다루는 피싱 이메일은 첨부파일이 있는 이메일만을 대상으로 한다. 이메일 제목과 첨부파일 명에 등장하는 숫자는 일반적으로 고유 ID 값으로서, 이메일 수신자에 따라 다를 수 있다.
가짜 로그인 페이지(FakePage)
| 이메일 제목 | 첨부 파일명 |
| 【전자 영수증】받은 새 전자 영수증[영수증 번호: 88897075434806572392] | NTS_eTaxInvoice.html |
| 증권 – 배달 통지 | Dhl#Doc.html |
| 중요하지 않음 (주)**(주식회사 *****->(주)***) | NTS_eTaxInvoice.html |
| DHL : 화물도착안내976297629762 | 97629762_DHLInvioce#Track.shtml |
| RE: 최고 긴급 | Order_190820244.pdf |
| FedEx 수입 통관 정보 제출 안내 ? AWB # – xxx20240828 | 3347933479_FedexInvioce#Track.shtml |
| DHL :화물도착안내351235123512 | 35123512_DHLInvioce#Track.shtml |
| 제목: 구매 주문서 INV AR-916549 RFQ | adobedocunent.pdf |
| 화물도착안내 | fdx_awb#425.html |
| RE: shipping documents (Original BL, CI & PL) | awb.htm |
| New Company Policy Added To Our Employee Handbook 0228 | Complete_with_DocuSign_Jinghua Han_4841.pdf |
| Payment sent on 29/08/2024 02:19 . | (Payment Advice.PDF).htm |
| shipping documents | awb_packing list.htm |
| Payment sent on 29/08/2024 22:02 . | (Payment Advice.PDF).htm |
| wenger berlin r-ezeptfrei einkaufen | 5bdaf840-6e54-11ef-b32a-44a842253044.html |
| Payment sent on 29/08/2024 16:06 . | (Payment Advice.PDF).htm |
| FWD: New Order //Address:- PAYMENT 907 St, changhai NC 27577 — File#: ANS-810364 | PI-576565677666.xlxs (8).ShTmL |
| Employee Benefits Received:7SO6-DORN6H-VCC2 | sharon.yang-Employee-Benefits.docx |
| FWD: New Order PO2024 /Contract Document | NEW ORDER PO-576565677666.xlxs (8).ShTmL |
| PARCEL ARRIVAL NOTICE | AWB63296439.html |
| Purchase Order | PO.Adobe-xlsx.shtml |
| ********@*******.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| Payment sent on 29/08/2024 02:57 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 19:37 . | (Payment Advice.PDF).htm |
| **@****.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| **@****.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| DHL Express Shipment Arrival Notification For ******@********.co.kr | DHL SHIPPING DOCUMENT.html |
| Payment sent on 28/08/2024 11:20 . | (Payment Advice.PDF).htm |
| DHL Express Shipment Arrival Notification For *******@********.com | DHL SHIPPING DOCUMENT.html |
| Payment sent on 29/08/2024 20:02 . | (Payment Advice.PDF).htm |
| Payment sent on 28/08/2024 11:32 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 16:07 . | (Payment Advice.PDF).htm |
| Payment sent on 28/08/2024 22:25 . | (Payment Advice.PDF).htm |
| [Action Required] DHL Shipment Notification | AWB #441000322.Html |
| Payment sent on 29/08/2024 05:15 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 00:35 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 06:17 . | (Payment Advice.PDF).htm |
| *****@****.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| Re: New Order | PO f433.pdf |
| FW: PERINTAH PENGADILAN RESMI | Konteks Hukum.pdf |
| Payment sent on 29/08/2024 06:21 . | (Payment Advice.PDF).htm |
| Invoice Copy for Registration | Item14# Paid.htm |
| *****@*****.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| ***@*****.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| *******@****.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| Payment sent on 29/08/2024 00:36 . | (Payment Advice.PDF).htm |
| Deadline for Benefits Enrollment | Complete_with_DocuSign_Jinghua Han_8437.docx |
| Payment sent on 29/08/2024 05:23 . | (Payment Advice.PDF).htm |
| PO203074 – SO102803 – TOP Most URGENT | Factura-2218.html |
| Real Estate Multipurepose cooperative Society co.ltd NEW ORDER | DHL DOCUMENT.html |
| Fw: Payment Advice – HSBC Bank, UTR Reference HS32128Q002024 | HSBC PaymenT Receipt pdf.shtml |
| Your Decentralized accounts will be suspended | Instructions Advance2FA.html |
| Payment sent on 29/08/2024 02:06 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 06:40 . | (Payment Advice.PDF).htm |
| TY76392 INV569254 RFQ. | Scanned Document.pdf |
| Payment sent on 28/08/2024 12:31 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 03:42 . | (Payment Advice.PDF).htm |
| Payment sent on 28/08/2024 13:19 . | (Payment Advice.PDF).htm |
| ****@****.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| Complete with Docusign: *****.***@***.com_PP95489SF-August 2024-Lge.pdf | Complete_with_DocuSign_Jinghua Han_1144.pdf |
| ?? You Have (10) Undelivered-Message Pending | chongroyuhak.com 8 Undelivered Messages.shtml |
| *****@**********.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| Payment sent on 29/08/2024 19:12 . | (Payment Advice.PDF).htm |
| ****@************.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| Payment sent on 28/08/2024 13:24 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 16:43 . | (Payment Advice.PDF).htm |
| Payment sent on 30/08/2024 00:26 . | (Payment Advice.PDF).htm |
| DHL Express Shipment Arrival Notification For *******@*****.com | DHL SHIPPING DOCUMENT.html |
| ?的包?到?了我?的工? 8/27/2024 6:36:24 p.m. | INVOICE.pdf.htm |
| Purchase Order RFQ. | Purchase Order.pdf |
| Payment sent on 28/08/2024 16:50 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 23:36 . | (Payment Advice.PDF).htm |
| ****@********.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| *******@*********.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| Payment sent on 29/08/2024 17:25 . | (Payment Advice.PDF).htm |
| Fwd: shipping documents | awb_packing list.htm |
| Payment sent on 28/08/2024 23:18 . | (Payment Advice.PDF).htm |
| Factura. A la espera de pago… | Factura_724671.pdf |
| Payment sent on 29/08/2024 23:17 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 04:12 . | (Payment Advice.PDF).htm |
| Re: Purchase Order 1400126265 | PO#08383022.html |
| WIRE COPY $ 16,000 | WIRE COPY $ 16,000.pdf.htm |
| ******@***********.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| Payment sent on 29/08/2024 20:22 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 01:14 . | (Payment Advice.PDF).htm |
| Payment sent on 28/08/2024 11:39 . | (Payment Advice.PDF).htm |
| Payment sent on 28/08/2024 22:27 . | (Payment Advice.PDF).htm |
| Re: Confirm your App Purchase – App Purchases Will Be Processed on Friday, August 30, 2024 #AT6TS7M919 | HellBoy APP #AT6TS7M919.pdf |
| Purchase Order JH 24-7 | PI 24-8.pdf |
| Payment sent on 29/08/2024 02:52 . | (Payment Advice.PDF).htm |
| ?? You Have (10) Undelivered-Message | coei.com 8 Undelivered Messages.shtml |
| Payment sent on 29/08/2024 21:51 . | (Payment Advice.PDF).htm |
| Payment sent on 28/08/2024 13:38 . | (Payment Advice.PDF).htm |
| ****@*********.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| Payment sent on 28/08/2024 23:32 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 21:05 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 19:42 . | (Payment Advice.PDF).htm |
| Payment sent on 28/08/2024 11:14 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 04:51 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 19:11 . | (Payment Advice.PDF).htm |
| Payment sent on 28/08/2024 14:12 . | (Payment Advice.PDF).htm |
| Payment sent on 28/08/2024 11:15 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 18:28 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 01:34 . | (Payment Advice.PDF).htm |
| Payment sent on 28/08/2024 12:46 . | (Payment Advice.PDF).htm |
| Payment sent on 29/08/2024 20:51 . | (Payment Advice.PDF).htm |
| ******@********.comYou have an incoming files via WeTransfer_[PAYMENT VOUCHER.pdf] | Payment pdf.shtml |
| We_specialize_in_plastic_and_rubber_industry_exhibition_setups | 6c083ba1-6ef0-11ef-b220-44a842253044.html |
악성코드(Infostealer, Downloader 등)
| 이메일 제목 | 첨부 파일명 |
| 답장: 구매 주문서 PAH24200524-HSIN | Advice Copy-$72,000-114571_pdf.gz |
| DHL Express SHIPPING NOTIFICATION | Page1.img |
| Thermo Fisher RFQ_TFS-1805 | Thermo Fisher RFQ_TFS-1805.xls |
| FedEx Shipment Notification | FedEx Shipping Confirmation.zip |
| Thermo Fisher RFQ_TFS-1407 | Thermo Fisher RFQ_TFS-1407.xls |
| You have a upcoming shipment via FEDEX AWB *****4911 | AWB.IMG |
| Thanks for Your Efforts: We’re Upgrading Salaries! | Employee Sept_2024 Salary.arj |
| Partner in Growth: Navigate Your Financial Goals | Employee Sept_2024 Salary.arj |
| YOUR EMPLOYMENT STATUS | Salary_Receipt.rar |
| Long outstanding and overdue | Long Overdue debt.zip |
| PURCHASE ORDER POT2408-0055 | POT2408-0055_PDF.LZH |
| Booking Package | Booking_6037.rar |
| Advantech PO:0011825728/魏鳳君 Anita7.wei/20240826 | 0011825728.tar |
| ?价?求及供?商合作?? | 報價請求 – 樣本目錄.tgz |
| RV: RV: RV: RV: RV: RV: Estado de cuenta | estado de cuenta adjunto.zip |
| Scan Data from FF-1C7D22654C08 | Monday.xls |
| RA – Agrotis MEETING REQUEST | Paul Meeting Proposal and Schedule.xls |
| 70% Balance Payment For INV#BR029831 | 70% Balance Payment-INV#BR029831.com.xz |
| MV STAR SOPHIA / / Port Agent Appointment | STAR SOPHIA VESSEL’S DETAILS.docx.lzh |
| Immediately needed: CNC Equipments WNTlist | SMT-ListWNT.zip |
| JUSTIFICANTE -Carta de pago | TRANSFERENCIA.rar |
| FW: Nasign Vendor Bank Update Form for Electronic Payment | FORM – Nasign VENDOR BANK UPDATE DECLARATION _INFO#431403.html |
| Regarding the Order 8/29/2024 2:29:50 p.m. | QJAS2024P04-160 Q18-25_IMAGE.IMG |
| MV ARIS TBN // LOADING 70000MT COAL AT PORT// EPDA-PORT INQUIRY | ARIS TBN VESSEL PARTICULARS.lzh |
| AR statement as of 07/04/2024 | SOAJULY2.rar |
| AW: Purchase Order | NEWPO#20.gz |
| Exciting News: Salary Increase Ahead! | Salary Package.arj |
| COMMERCIAL INVOICE & BILL OF LADING | COMMERCI.gz |
| New order PO and forecast week 29 / rail shipment | FORECAST.7z |
| New order QE-2403KBR4 | Neworder.rar |
| New Order Request for quotation | RequestF.lzh |
| New Project Enquiry | NewProje.GZ |
| NXIL< NEW PURCHASE ORDER 5172024> | ORDER517.xla |
| ORDER INQUIRY | NEWORDER.bat |
| PURCHASE INQUIRY | PO229156.lzh |
| Purchase Order | PO-00032.rar |
| Purchase order 3403-XKO6BOO44 Arrival document – 33 boxes | Purchase.7z |
| Purchases Order // PO23100085 | PO231000.rar |
| Quotation #64894 | Quotatio.7z |
| quote | Quote#24.rar |
| RE: BANK DETAILS | PaymentD.tar |
| RE: Fabric booking S25 #1182131 | PO102675.7z |
| RE: Fabric booking Schoffel S25 #1182131 – Smartex C247SH45 | PO102675.tar |
| Re: Payment Reminder | PAYMENTC.Z |
| RE: Product availability and prices for RFQ_N211004 – September 2024 | RFQ_N211.GZ |
| RE: Urgent Request for Proforma Invoice (Reminder.) | TRIAL_OR.rar |
| Re:Re:PRICE REQUEST | CIFHyder.r00 |
| RFQ : (URGENT!) REQUIREMENT-HAMRIYAH STEEL FZC | RFQ46348.zip |
| RFQ No. 109078906 | RFQNo109.xla |
| RTGS Payment Advice | Payment_.7z |
| [URGENT] BANK INFORMATION ERROR/CONFIRMATION | BankDeta.rar |
| Urgent Dubia Buyer: Order Enquiry | Dubia_RF.gz |
| You have been fined by the UAE police | DubaPoli.rar |
하기 IOC상 MD5는 이메일에 첨부된 피싱 페이지 및 악성코드의 MD5 해쉬이며, URL은 피싱 페이지를 통해 사용자 계정 정보가 유출되는 C2 정보이다.
013bd67b1574c57b65ad508828713bf1
02e06b3b97fc5955aa6717e6105e80c8
0469ede862a5ead1940084b6391a5f98
0606e66c2c239e3565397977bb47a555
06a6f11c25329a5364a813c4f0b3ff34
http[:]//confidable[.]com/img/Expres[.]php
https[:]//bullchraister[.]com/SmWjr3M/feedback[.]php
https[:]//controlvisualch[.]com/wp-mm/kl/ado[.]php
https[:]//elsargados[.]com/FmQuuirm/feedback[.]php
https[:]//instelnet[.]pe/jir/data[.]php
AhnLab TIP를 구독하시면 연관 IOC 및 상세 분석 정보를 추가적으로 확인하실 수 있습니다. 자세한 내용은 아래 배너를 클릭하여 확인해보세요.
