the #malware for today was a unique upload to #VT
Under the guise of an #RFQ sourced from 155.94.211.180 - our "friends" at #quadranet #quadranetIsACesspool #quadranetDoesNotRespondToAbuseComplaints

Archive unpacked: RFQ.PDF.lzh (#application/x-rar-compressed; version=4, 790.57 kB)
#MD5:
bfd11c09d12e016a72838e3368da964a
#SHA1:
00654c1b168a06474a3a9d1ea24565f75ccb219f
#SHA256:
127363d38a9a18187a0e9244d31ab1804bc25c32638d207b53e4bdfdde44e14e
#sha512:
e221f2d41f1448325a0652c69650b7abc50e10419230659929044f103b39abc01265be9fa7c7e5af80f06a2077911d409cccda86d2581d899aa67920d5c6eaa4

Detected malicious per https://www.filescan.io/uploads/6628249675339da04f9d43fb
expands to RFQ.PDF.exe
https://www.filescan.io/uploads/6628249675339da04f9d43fb/reports/1bab72f3-3ef2-4462-8437-79e946c52bee/overview

#VT has 30/64 for detection as #trojan.#zmutzy/autoit
https://www.virustotal.com/gui/file/127363d38a9a18187a0e9244d31ab1804bc25c32638d207b53e4bdfdde44e14e/detection/f-127363d38a9a18187a0e9244d31ab1804bc25c32638d207b53e4bdfdde44e14e-1713906829

#spammers #scammers #malicious #suspectfiles
#malware #triage #ioc #_ioc #infosec #informationSecurity #IncidentResponce #IR
#spam #infosec #infomantionSecurity #virustotal

The other bogus #attachment is a #fakeInvoice from #geeksquad

the #fraudster call center numbers are:
844-799-3440
719-297-8098

#MD5
073d0627ecd901979b2f7daca3812ccb
#SHA-1
91279035cd7c98e900cb61ed7c2567701d9d1e41
#SHA-256
70c263efabeb149c9d9d91c4d2f21162ad5f9537eb59cfa0b922780465dcc7c1

Bill5252067237.pdf

https://www.virustotal.com/gui/file/70c263efabeb149c9d9d91c4d2f21162ad5f9537eb59cfa0b922780465dcc7c1/detection

https://www.filescan.io/uploads/661f0200c5dabc22b200d489/reports/ca8370b2-4fbd-4ddb-8182-659606d54368/overview

The #SRC #IP of the email was 72.11.157.148 an #openproxy at (of course) #quadranet

#spammers #scammers #malicious #suspectfiles
#malware #triage
#spam #infosec #infomantionSecurity #virustotal

today's #malware submission

https://www.filescan.io/uploads/6616c4a3279698d249ed44de/reports/7f0283ad-ac3f-4c6f-a095-0908860e1747/overview

from our "friends" at #quadranet
in #LA
another #openproxy
#spammers #phishing #malicious #maliciousexe

Many reports of hosting provider #QuadraNet (#AS8100) spamming recently shuttered provider DediPath (#AS35913) customers.

"[...] I am an Entreprise Account Manager here at QuadraNet. I heard you might be in need of a new data center partner to meet your needs. Don't worry, we've got you covered!"