Skip to main content

FaultyServer

Search This Blog

[Evidence Only] [Storm-1575] O365 Phishing Email policycontruction.com

on November 13, 2024

Get link
Facebook
X
Pinterest
Email
Other Apps

callerservicevoicemsg.policycontruction.com

kqnn.policyconstruction.com/next.php

Evidence Only Storm-1575

Get link
Facebook
X
Pinterest
Email
Other Apps

Comments

Post a Comment

Popular Posts

[Storm-1747] Tycoon Phishing Service Email Analysis

Malware Sample Analysis VirusTotal IOC Collection: View Collection Extracted Phishing IOCs Email Attachment (HTML file): 190374 pdf.Dhudnall....html EML Hash (SHA-256): 558f05937b1afcdce82b106599db2707428541abd040a009293b614293ac6d68 Attachment Hash (SHA-256): b3fe13c613f5c22e5211af8c576694800f8831d7f60d6e9863b40c4b54276320 Malicious URLs: https://bumblebeeclub.net/res444.php?2-68747470733a2f2f717a372e6763637678676d6f752e636f6d2f394d684370472f-leech This URL is obfuscated by the script source, likely to track or uniquely identify the victim and evade detection. https://activationmail-setupmailvalidationonlineaosaiaosuaos.es/#[email protected] Observed Domains: bumblebeeclub.net gccvxgmou.com ijmzazonz.com ntowardr.ru activationmail-setupmailvalidationonlineaosaiaosuaos.es Behavioral Analysis and Observations Phishing Server Response: Attempts to revisit the malicious URL led to a connection refusal, likely due to prior access from the Any.Run sandbox environment. The analysis ...

O365 Phishing Email Analysis

Malware Sample Analysis VirusTotal IOC Collection: View Collection Extracted Phishing IOCs Email Attachment (HTML file): View_receipt_details_U.html EML Hash: 1ea0b4ba1728ceda14a7cab6c79b2a70a5e07e6a514e5003766e7f9a75328e3e Attachment Hash: ecb269c37695c61474ca75ec6a39b5544bebe2bdb617e1bf98935fa310d1ee29 Malicious URLs: https://support-365dabwa46l17kupx.rsko-capital.com:8443/impact? https://sdsdsd.chiliesdigital.co.za/app/stiktk.php Observed Domains: seeklogo.com support-365dabwa46l17kupx.rsko-capital.com sdsdsd.chiliesdigital.co.za rsko-capital.com chiliesdigital.co.za iesm.edu.pe Behavioral Analysis and Observations Suspicious Attachments At first glance the email appears to have 3 attachments. Two image files and an html document. However, if we try to open the image files, we can quickly see they are something else the files are 0kb. Taking a look at the source code of View_receipt_details_U.html we can see that ...

[Storm-1575] ThunderDash Email Analysis

VirusTotal Collection: https://www.virustotal.com/gui/collection/873848a6a028db6451b8f887796134919e4f981c16c68c23ee72c95836040ce4/iocs 1. Overview The malware sample was initially analyzed by a third party via Any.Run with no immediate threats detected. However, a deeper dive revealed multiple phishing redirections targeting Microsoft O365 credentials. 2. IOCs and Hash Analysis Attachment Hash : f6d618128d0850704da57558c80a0a0602ef369aacda7ce65f2b580c84d8d311 Email Hash : fe2131b728d87262b96e42fd0f52900e5efb83fc2babe9a50700 3. Email Header Findings DMARC : Not Implemented SPF : Passed Verification 4. Phishing Attack Vector Initial QR Code URL : https://epyfl.org/ad_hits.asp?idBanner=17&txtLink=https://auth-endpoint-gfh7ape8h5auesae.westus-01.azurewebsites.net/index.php/auth/v/?id=abc123XYZ4567890/message?data=/login.aspx Redirection Path : Leads to Cloudflare bot check and finally to a fake O365 login page hosted at: https://three03828922939389248u2u22.onrender.com/gov-ni-nda...

Powered by Blogger