🌐 Campagne #Malware in Italia - Week 49

📞 #APK Bank
🕵️‍♂️ #SpyNote / #Antidot / #Irata / #DroidBot / #SmSSpy
✉️ Email Campaigns
💼 #Formbook: Preventivo
📦 #AgentTesla: Spedizione
📑 #Remcos: Fattura
💰 #GuLoader: Pagamento
🧾 #XWorm: Fattura
🐍 #SnakeKeyLogger: Bonifico
🔖 #Lokibot: Prezzo
©️ #Rhadamanthys: Copyright
📄 #VipKeyLoggerL: Documento

📢 Resta vigile! 🚨

#mwitaly #CyberSecurity #StaySafe

Campagne #Malware #Italy Week 47

mwitalyenti 🔥 ☠️
#AgentTesla: Richiesta Urgente
#SmsSpy: APK Banking
#Pikabot: Resend
#RemcosRAT - #SystemBC: AgenziaEntrate

D'Eccezione 💣 👻
#StrRat: Fake e-commerce
#Vidar: Resend

#mwitaly

Campagne #Malware #Italy Week 43

🔥💣☠️

#AgentTesla: Ordini e Pagamenti
#Remcos: Contabili
#Pikabot: Resend 📧
#GuLoader: Preventivi
#SMSSpy: App di Sicurezza Gratuita

#mwitaly

Campagne #Malware #Italy Week 38

☠️💣🔥

#AgentTesla: Pagamento Bancario
#Brata - #SMSSpy: #APK Bank
#Ursnif: Pagamenti SMB
#AveMaria - #AsyncRAT: Ordine
#Formbook: Fornitura
#ScreenConnect: Pagamento
#BitRAT - #RemcosRat: Documento

#mwitaly

🚨#Malware Alert
File type: #Apk #Android
Threat name: #IRATA #spyware
(IRATA - Iranian Remote Access Tool Android)

- Payload URLs:

hXXp://eblaghshekayatname.hyperphp.com/sana.apk

IP : 185.27.134.59
ISP: AS 34119 ( WILDCARD-AS - Wildcard UK Limited ) GB
Registrar: NAMECHEAP INC

- Payload:

https://bazaar.abuse.ch/sample/91e5c5dbb6e64f5399cd4786f2e91192525b6582a088a8b583a7599a82838567/

#smsspy #spyware #Phishing

🚨#Malware Alert
File type: #Apk #Android
Threat name: #IRATA #spyware
(IRATA - Iranian Remote Access Tool Android)

- Payload URLs:

hXXps://openaico.ir/bot/stream/dl/?q=r6wp3wkS4rU

IP : 157.90.108.250
ISP: AS 24940 ( Hetzner Online GmbH ) DE

- Payload:

https://bazaar.abuse.ch/sample/f403f15de411e46b588b0454694a868adf692ac5e7294d07bd3216d500971d3f/

- C2

gamerdet[.]tk

IP : 172.67.174.204, 104.21.72.41
ISP: AS 13335 ( CLOUDFLARENET ) US

#smsspy #spyware #Phishing

🚨#Malware Alert
File type: #Apk #Android
Threat name: #IRATA #spyware
(IRATA - Iranian Remote Access Tool Android)

- Payload URLs:

hXXps://ceryew2ir.com/ed.apk

IP : 185.143.234.120
ISP: AS 205585 ( Noyan Abr Arvan Co. ) IR
Registrar: NAMECHEAP INC

- Payload:

https://bazaar.abuse.ch/sample/95daed761fda53bc7acdce7b880c1cb661bf75988084914e0958d33314768fa1/

- C2

hXXps://xreyz.com/000
hXXps://xreyz.com/000/rat.php
hXXps://xreyz.com
hXXps://xreyz.com/000/url.txt

IP : 185.143.234.120
ISP: AS 205585 ( Noyan Abr Arvan Co. ) IR
Registrar: NAMECHEAP INC

#smsspy #spyware #Phishing

🚨#Malware Alert
File type: #Apk #Android
Threat name: #IRATA #spyware
(IRATA - Iranian Remote Access Tool Android)

- Payload URLs:
hXXps://site2.ebl-ir.org/adl.apk
hXXps://site3.ebl-ir.org/adl.apk
hXXps://site4.ebl-ir.org/adl.apk
hXXps://site5.ebl-ir.org/adl.apk
hXXps://site6.ebl-ir.org/adl.apk
hXXps://site7.ebl-ir.org/adl.apk
hXXps://site8.ebl-ir.org/adl.apk
hXXps://site9.ebl-ir.org/adl.apk
hXXps://site10.ebl-ir.org/adl.apk
hXXps://site11.ebl-ir.org/adl.apk
hXXps://site12.ebl-ir.org/adl.apk
hXXps://site13.ebl-ir.org/adl.apk
hXXps://site14.ebl-ir.org/adl.apk
hXXps://site15.ebl-ir.org/adl.apk
hXXps://site16.ebl-ir.org/adl.apk
hXXps://site17.ebl-ir.org/adl.apk
hXXps://site18.ebl-ir.org/adl.apk
hXXps://site19.ebl-ir.org/adl.apk
hXXps://site20.ebl-ir.org/adl.apk

IP : 20.74.163.6
ISP: AS 8075 ( MICROSOFT-CORP-MSN-AS-BLOCK ) UAE

#MICROSOFT #Azure

- Payload:

https://bazaar.abuse.ch/sample/decab5c7e9a8d42e09aa6df39385c95dc603285374a76d8c8e08a025bb7e1dd9/

#smsspy #spyware #Phishing

🚨#Malware Alert
File type: #Apk #Android
Threat name: #IRATA #spyware
(IRATA - Iranian Remote Access Tool Android)

- Payload URLs:
hXXps://panel1.iran-pspcoi[.]info/adl[.]apk
hXXps://panel2.iran-pspcoi[.]info/adl[.]apk
hXXps://panel3.iran-pspcoi[.]info/adl[.]apk

IP : 20.74.163.6
ISP: AS 8075 ( MICROSOFT-CORP-MSN-AS-BLOCK ) UAE

#MICROSOFT

- Payload:

https://bazaar.abuse.ch/sample/e0452b81b45a3a36dbabe7522d5ca942635448283f32c35f05d13990480a21ea/

#smsspy #spyware #Phishing