January Malspam Campaigns

gistfile1.txt

Date,Details,Email Payload Type,Users Targeted
1/2/2026,Please Review the Tax Violation Notice Promptly; link -> rar -> rustyloader continued to,Link,2
1/4/2026,Your document; zip -> lnk -> exe -> phorpiex -> mamona ransomware,Attachment,106
1/9/2026,"Complete with DocuSign: ETF08 - 09 January, 202616:53:40 PM; link -> action1",Link,4
1/15/2026,Purchase Order and Company Profile 2026; rar -> js -> xworm,Attachment,3
1/15/2026,YOUR SSA e-Statement IS READY!; zip -> url -> msi -> action 1,Attachment,3
1/15/2026,Signature Requested Via Docusign; link -> msi -> screenconnect,Link,26
1/16/2026,YOUR SSA ELECTRONIC STATEMENT NOTICE!; zip -> link -> msi -> screenconnect,Attachment,10
1/17/2026,Request for Quotation P.O4847358 // Urgent; zip -> xloader,Attachment,23
1/19/2026,You have recieved a shared document via WeTransfer 1/19/2026 9:41:55 AM; link -> msi -> screenconnect,Link,7
1/19/2026,Remittance Advice (Multiple Invoices) � ZIP Attachment; zip -> cmd -> msi -> screenconnect,Attachment,4
1/19/2026,mv TOI CHALLENGER // BIK PORT PDA FOR DISCHARGE; zip -> js -> xloader,Attachment,4
1/21/2026,RE: Requesting For Quotation; zip -> hta -> originlogger,Attachment,3
1/21/2026,Remittance Advice � Payment Details (ZIP Attachment); zip -> cmd -> link -> msi,Attachment,7
1/23/2026,Attachment name is bankconfirmationswiftreceipt.zip; zip -> xloader,Attachment,3
1/25/2026,RE: ?????RFQ#40818136; docx -> rtf -> dll -> xloader,Attachment,2
1/26/2026,Re: New Invoice - 23Jan'26; xlam ; xworm -> phantom stealer,Attachment,3
1/26/2026,Regarding a Possible Issue with Your SSA Earnings Statement; link -> msi -> screenconnect,Attachment,3
1/27/2026,REF: # QUOTATION 8026844-20262701 -  AUTO-WELL EXP & IMP #1000; z -> xworm,Attachment,2
1/28/2026,RE: T/B Shark5 & Universal - Invoice reminder; xlam -> reverseloader -> xworm -> phantomstealer,Attachment,5
1/28/2026,RFQ No. SG01260021R02|KLRI 6128 - Ace Travel Solutions; bz2 ->,Attachment,3
1/29/2026,RE: Vertimac > PO 34318 CO-2507008-AAI-250805; bz -> vbs -> xworm,Attachment,2
1/30/2026,Annual Reminder to Review Your Social Security Statement; link -> vbs -> msi -> screenconnect,Link,5
1/30/2026,Final shipping documents; zip -> phantomstealer,Attachment,4

action1, 84444d44ee0e4f1d8a4b312f55e9f0fb58a336523ba6f9ac71fba506d613dad7, company_id_2642e654-e24b-43b0-a472-3ac396a290f0
action1, 8c51cc3ffecb13ce4c6fec1676d38a8b4953916e47281ba9ce5e97dd4e12d741, 085c2b7d-3bc5-4a86-b682-2498bd2d8628
darkcloud, 306c682a2b48af83475bc34adb4e33c0cd7b3c796b562dcc24d71f9a49d54072, https://api.telegram.org/bot7604763754
darkvision, eda7a5216e8eba7d8648d7160bf64a09f142cdb24163649693d0347f74a65757, toolz.3utilities.com
destinystealer, 0e7aa42d81a35200a205b426dd88c0c487b785851a081bedd9978ced12fb09de, 86.54.42.197
expiro, 2986b0bd4774daf7ffbfa4f6fd239a3842e98c5774ea14ebf4726a4f8fca2a30, http://pywolwnvd.biz/rsacrvrypjc
expiro, 5167338e9391173e6017b1aa8a79bf23093f3673494199d6a92e5b77e0bd4aa2, cvgrf.biz/fecvpfmeagpmefe
expiro, 5c523a295e64ca123dda4f517b1c9ee609af1f33ad3d8879c0e56505141a81d9, vcddkls.biz/xgaxcsitrdwb
expiro, 60f7e26dce7596c24ce870eead6fabbbffd8f164f5c1ed09a23a460ae8363af1, eufxebus.biz//mdysh
expiro, 6eb4bdd8ec2a01033803c139351d0fb38f919b7afda79afbc3a321609f5300b1, saytjshyf.biz/je
expiro, 7d430bdeccbced4e2edfaecf2854fc4a89b6002d8bcc63a0bfab14c0e03b1060, lrxdmhrr.biz/em
expiro, e87594f0f7fb132935f164ff5daca596698c14cbbdb1946af86e45bbed834bd4, ssbzmoy.biz/v
gotoresolve, 7dc80f38cdef77c86e4a46bbcaa08b2fb9393d04bbcb1909e096cd81414fbebb, 3615702657357973265
guloader-originlogger, 679251cd67ff6789381c21600031bde25b162453ebb53f6d803c6d5e1a621113, v1551.securen.net
guloader-originlogger, c6cf52d8673ca3f170779f30f90e3709b1c9f1372476e76a52b9e776f0e4b08c, ftp.aventour.com.mx
guloader-phantomstealer, 8b490fc084291f3a7ee098f2621f87c57528294de2101ae1a1ec1a5aba228026, https://api.telegram.org/bot8266521044
guloader-phantomstealer, b4ea21927cb25b5e3123374e9bee0a916d6bc74b1ce59b721be7c8d01b94b2cd, https://api.telegram.org/bot8460788277
originlogger, 51ba2e9418b122866ee7b8329f44aac3f80c026de7830d1e551fdb2c535b8641, mail.natavel.com
originlogger, 6ff1c82dec854fb2bdce8441e8061c4496f0199a3f96ad0b028699aafbc310d1, 185.149.24.38
originlogger, 928b2061aedb3ca6e65a4156966564dc3ded14c6fecc7d38268fb5cef884c3d0, ftp.yukimoto-official.com
originlogger, ab42c8162c7bbb04f97eeafe0b3a5cf13ab83e9aa8a893dc0fc9f0bb59475167, st70683.ispot.cc
phantomstealer, 209c2dca137fd4d7cefee9f203f2cf8d5136c03fa5159f4ba1a214212ce584c8, mail.briscool.com.tr
phantomstealer, 2af499fac05701bca739a99203f8c8c34f8d4d8b1ca9d68857803416bb89bf58, https://api.telegram.org/bot8202902973
phantomstealer, 532c5ca7e505b70c97ab8d3ba15d48d1fc8c5f04e9935e52104ffe97b8eef7e3, https://api.telegram.org/bot8473325943
phantomstealer, 54fe353ca8d2abb920624cb0314f811ef03f80a57c2199e8f65a25300f86ad3e, https://api.telegram.org/bot8412228056
phantomstealer, 7dd1eb0fb7d51e0fe42cf8aebcaadab568f22496d9ea72a3abcbf4cc4bb5f6f4, mail.dibqatar.com
phantomstealer, 964d4b61e395c59cd42622f47548761dea365ae41d02b7451a039c5daf7a7fa8, https://api.telegram.org/bot8205340421
phantomstealer, 9778c5d38df1de33a48dc66990239b1935620ea98e7d0137913d2bb9b20df666, https://api.telegram.org/bot8205340421
phantomstealer, ab69b8d4f4daadb6f01643fb6c6c4fabf365a208524827df4bd1fdab20c14f39, mail.lodenrandmarines.com
phantomstealer, ea8c94c322bfcb950b6ed1e672819b930feff110eb33ff0bb8d00a8977757e3e, https://api.telegram.org/bot8238861080
phantomstealer, fd37a8a4d978e8c35d1522d8b14b9f3cd0e2bbd4c210e2a5cdd3bd1d0c254cec, mail.lodenrandmarines.com
phantomstealer, fd37a8a4d978e8c35d1522d8b14b9f3cd0e2bbd4c210e2a5cdd3bd1d0c254cec, query=mail.lodenrandmarines.com
phorpiex, 1bdbb46e7a4722311e5baefa1eb48cfca30581f1ee597a84b5b43e67f2f2470b, http://178.16.54.109
remotemanagement, 13b593448ccc629b176dedaaa0eca6c027ec7f7b095697d6c9d4bc5b3b8547f5, https://upload1.am.remote.management/command/agentprocessor_v2.php
reverseloader-remcos, 3108e12991421edf2db009520b87ec9827495ffc9d442f574b011b54fb297215, mismilahioluwadoam.duckdns.org:14643
reverseloader-xworm, 67e7b0bf057c8c7ef117be16a168833235920d0af16921ff59d0866f0d05e050, 203.202.232.228:3490
reverseloader-xworm, d732ab885b9e087cb84a46964abe41bf8ffb62f08f8bda7f389c9c799dbcd8cf, evaultbuzzfix.com:6000
reverseloader-xworm, dbbb1c1ad17996d18e3e28537e0188b204657e87b8cb495e05bdb36c75cae466, 158.94.210.127:6991
reverseloader-xworm-phantomstealer, 3e0a69c6f77579a54a4394d821883f131c33364bddacf4c1ebee07950a707475, aaslooria.com:6000
screenconnect, 04e60ecb0da1a557169fa5035d5723c534c8eb9828496e3a20593b1a8611b304, 154.30.4.201
screenconnect, 04e60ecb0da1a557169fa5035d5723c534c8eb9828496e3a20593b1a8611b304, 154.30.4.201:8041
screenconnect, 12dd069259db2bf3e11cac8c160da5482f552e1cb164d02e5f55ca98668d764c, instance-bnmh3v-relay.screenconnect.com
screenconnect, 2c49a0069f0c861a29b268d23844d318c285e5526a3eeaebd39b760aad05b62a, 104.249.130.135
screenconnect, 2c87b070087fedf276de6056afb6459db2659725129cd71c9e82880061e4a94b, 154.30.4.201
screenconnect, 4990164c8296288b93e66901737c1840b43a71adc06ad0ab8ab2bb50aaad22a8, instance-c9dq22-relay.screenconnect.com
screenconnect, 6a9fdfe61ede8c5b95182c96a3552e53e6ce6a8014b0f5bcb2b310f893928e5c, instance-ttx7np-relay.screenconnect.com
screenconnect, 94853e74bcf9030c67e896e7443d0d953d4c3e3e0ae42ff8f6dc93a07b65b954, 192.210.236.141:8041
screenconnect, 951c14b0fc69516a53aa5e7f3e943f1485ffb0488eac3a3d2d0afd2beda485f0, 135.148.52.104
screenconnect, d85512a94b3132cb82b6ce2b87f4306ccb7f9f4d02462c7bbf2378857ce0c48e, web-safestud.net
snakekeylogger, 3f30eb884452a6b86c47244eaaf528b7e517b6ac85a6c85099e57d7c69fd944b, https://api.telegram.org/bot7746141622
snakekeylogger, 401807d43ef232e8e4109f2a9c7ba1c464376904a01cb92532d49277a0b4e140, mail.sanysouthafrica.com
snakekeylogger, 799fda3ecc1dd25a3100b87ab8b41678a32ac761ecf75f59167eb77f91e0a3a1, mail.onionmail.org
snakekeylogger, a5f0289825409d89743cc64f0b4a67ffa8f5166a5576ed44724e96a54c9e4465, globalmaritime.pk
snakekeylogger, bedc78d97f795d218b247e923f1e7b671543c471b29387805040c1676f6a2115, mail.onionmail.org
snakekeylogger, e1319403e5c5f43c40c8493697fbf7f5edd1a90cf560f8ba5a66978ab43f3cf8, mail.sanysouthafrica.com
snakekeylogger, f446558cf18b5e60ec3d82d15d6279157fce23baa244fd5d05f26057ffc17def, mail.onionmail.org
xloader, 134eea8fe91833497d6801064356ba383aa6b6ae297510b289a65a0d2cb33d60, http://www.activosbac.com/ea0g
xloader, 24b6c681c03f5a93f0fdecf2d062f6cef392464b08913343e185e79040ca96be, http://www.unitedsharesbank.com/060g/
xloader, 44ece3fd771b241e7adb7b8a46317aa0dce39aa4b815912805de4dc6ff631ae4, www.unitedsharesbank.com/060g
xloader, 4e104d928c12846758db6ba19844f9fa2482db80fa67c82bb909ebb9e146867a, www.unitedsharesbank.com/060g
xloader, 5a721e420c6fc129a198af6fd7458202c574cff68e0b60b4372a8af5767bd2d9, http://www.unitedsharesbank.com/060g/
xloader, 977fd65072acdda9c793d7476db45d924312d67e31804b5967efa72e8cb47f0d, http://www.nvidias.in/b28p/
xloader, a8dc0bdbad4d31a5074b18f31cd2718a637d080a8770ba2c7c03032b2a1bff2d, http://www.activosbac.com/ea0g/
xloader, bc95420a75267e152a23ea91c08db6a697bdebff2f6c9416fd8df11f44914aa1, http://www.unitedsharesbank.com/060g/
xloader, c6aa56afa7a6941d9bb8786b07e192ea996d3a133c992285b58349cc5c204561, www.unitedsharesbank.com/060g
xworm, 342b5e56a768327e1cd56f4beab2edadd759b0dd34a4dbed0e612a95a30147c9, uaepremuimexporters.com
xworm, 45f12acd65a1b177c8d4d15f5a5e8f5e6ae4cb3bfbdfd37ac67cc4bad8a6735d, 158.94.210.127:6991
xworm, a678a980c32e990503463aafe48c9812ad20ac1a7c06caf821007f56d3cce6cf, 203.202.232.228:3490
xworm, b59f237069f8faccd2b47d23767c95ef269ea70bd910ad816728568afb9bec65, rency.ydns.eu:59013
xworm, c401d6ac6b29539dc104f23d19ff4bf752578bc11fa6f558d026f7d59b7bf787, 203.202.232.228:3490
xworm-phantomstealer, ec75fbd3c2aced4224014b7c613fc2aa19e11833381d52dee1b95a29690a49bc, fiber23-R.iaasdns.com

accounts@globalmaritime.pk
info@sanysouthafrica.com
lovelove12@onionmail.org