malicious attachment via e-mail, furthermore trying to mask itself as Ziraat Bank
date = 2025-04-03 ...
show moremalicious attachment via e-mail, furthermore trying to mask itself as Ziraat Bank
date = 2025-04-03
source IP = 111.67.68.23
type = malware
from = mail.1st-cable.com
sha1 = 574edba698cce79e735211a885ba6a45b69b03fc
attachment = e-dekont.exe
show less
.vbs script via e-mail
Date = 2025-03-31
Source IP = 103.83.87.57
Type = Malware
SHA1 = dbc58003 ...
show more.vbs script via e-mail
Date = 2025-03-31
Source IP = 103.83.87.57
Type = Malware
SHA1 = dbc580035ba3dc14d48a4eabf611ce49aa640e82
Filename = Order# HTS-0209 - April.vbs
show less
malware via phishing e-mail
Date = 2025-04-02
Type = malware
Source IP = 172.245.56.118
SHA1 = 7 ...
show moremalware via phishing e-mail
Date = 2025-04-02
Type = malware
Source IP = 172.245.56.118
SHA1 = 72b4d867303c95a2ca496ce6858a93241b6a6811
Filename = Satınalma siparişi O'073625N 100098 SI Sözleşme inN.tar"
show less
phishing e-mail which contains visual basic script
date = 2025-03-26
type = malware
source IP = ...
show morephishing e-mail which contains visual basic script
date = 2025-03-26
type = malware
source IP = 77.90.153.153
Destination port = 25 (SMTP)
sha1 = 270a1bcd9a053a8cc30f3cffe5d4a3d18ec977e5
filename = TT Bank Slip.vbs
show less
malicious .js via e-mail
date=2025-03-25
type=malware
source IP=193.222.96.186
sha1=d1aab7d ...
show moremalicious .js via e-mail
date=2025-03-25
type=malware
source IP=193.222.96.186
sha1=d1aab7dc8e3d3e494dd0a95e1c172a32f8fb7655
filename="Inquiry Purchase Order 25.03.2025.js"
show less
phishing e-mail which includes malicious .vbs script
from = [email protected]
file ...
show morephishing e-mail which includes malicious .vbs script
from = [email protected]
filename = 24-02503_190776.vbs
source IP = 89.34.230.89
type = malware
SHA1 = 1f2911eeba84cd612959f4ef8af2da80e50f8ab2
show less
malicious .vbs script as attachment
date = 2025-03-24
From = [email protected]
type = malware
...
show moremalicious .vbs script as attachment
date = 2025-03-24
From = [email protected]
type = malware
Source IP = 89.34.230.79
Filename = yeni sipariş.vbs
sha1 = bb06b21f452dea3abeb8cc8e83628c305ee127f8
show less
received trojan infected pdf from [email protected] which has IP of 159.253.120.56
202 ...
show morereceived trojan infected pdf from [email protected] which has IP of 159.253.120.56
2025-03-24 type=virus from="[email protected]" client_name="bizgaloreeetrade.blog" client_ip="159.253.120.56" msg="The file hesaphareketi_24_03_2025_20kb pdf________________________________________________________________________pdf__.7z is infected with MSIL/GenericKDS.61009645!tr."
show less
contains .vbs script in e-mail, which bypassed mail solution however sandbox has detected
date=2025 ...
show morecontains .vbs script in e-mail, which bypassed mail solution however sandbox has detected
date=2025-03-24 type=malware level=alert sourceIP=91.193.19.65 sha1=220ef1087a071ad3265d78c9069e96a3a79742f4 risk="High Risk" file name="Payment_Advice.vbs"
show less
msg="MIME data detected to have a virus and blocked." action="blocked" service="SMTP" srcip=196.251. ...
show moremsg="MIME data detected to have a virus and blocked." action="blocked" service="SMTP" srcip=196.251.92.62
show less
Known malicious javascript which is Order.js sent from this IP as an e-mail
<25>2025-03-14T07:48: ...
show moreKnown malicious javascript which is Order.js sent from this IP as an e-mail
<25>2025-03-14T07:48:24 date=2025-03-14 time=07:48:24 logid=1015000205 type=malware subtype=malware level=alert jobid=7592445631669851909 scanstart=1741938501 scanend=1741938504 srcip=158.58.172.215 srcport=1 md5=59d8f304342606edfb6703049b59752b sha1=afdf08af8bc335d9aae615c76592e7d237dafa45 sha256=1bb475113e7a84bbc6185564b35da5e479629a7a4accbe1de5c35cc100f3012f jstatus="Done" risk="High Risk" filename="Order.js"
show less
Sophisticated phishing e-mails, they first search and try to learn as much as possible about your co ...
show moreSophisticated phishing e-mails, they first search and try to learn as much as possible about your company. Then they send e-mail to workers which looks realistic enough.
show less