Resubmissions

04/06/2026, 09:55

260604-lx2tlact3x8

04/06/2026, 09:45

260604-lrfn6scs3s8

General

  • Target
    88e0ca02-c972-2857-5216-5bff81aae9bb.eml
  • Size 102KB
  • Sample260604-lx2tlact3x
  • SHA256 fbd166a753639211705cf02a3ac4a9445cf4aa8741452868bac80fd6b15d9c49
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 88e0ca02-c972-2857-5216-5bff81aae9bb.eml
    .eml 102KB
  • email-html-2.txt
    3KB
  • email-plain-1.txt
    1KB
  • gocomet_japan_deck_v3.html
    .html .js 60KB

88e0ca02-c972-2857-5216-5bff81aae9bb.eml

  • SHA256 fbd166a753639211705cf02a3ac4a9445cf4aa8741452868bac80fd6b15d9c49
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
dontwasteyourtimeinemeyouallreadythevoiceinsidemyhead

Email Headers

In-Reply-To

SI2PR04MB51280C5067BE376D49A1E186C2132@SI2PR04MB5128.apcprd04.prod.outlook.com

Return-Path

[email protected]

Date

Thu, 4 Jun 2026 17:05:11 +0800

Subject

Re: Japan Cloud <> GoComet

Content-Type

multipart/mixed; boundary="0000000000002919ca065369d8aa"

Received

from SG2P153CA0024.APCP153.PROD.OUTLOOK.COM (2603:1096:4:c7::11) by SI2PPFFA909A52F.apcprd04.prod.outlook.com (2603:1096:f:fff6::7f3) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.92.7; Thu, 4 Jun 2026 09:05:26 +0000

from SI1PEPF000161BB.SGPP274.PROD.OUTLOOK.COM (2603:1096:4:c7:cafe::7a) by SG2P153CA0024.outlook.office365.com (2603:1096:4:c7::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.8 via Frontend Transport; Thu, 4 Jun 2026 09:05:26 +0000

from mail-oo1-xc36.google.com (2607:f8b0:4864:20::c36) by SI1PEPF000161BB.mail.protection.outlook.com (2603:1096:f:fff6::25) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.5 via Frontend Transport; Thu, 4 Jun 2026 09:05:25 +0000

by mail-oo1-xc36.google.com with SMTP id 006d021491bc7-69de237f0a3so342181eaf.1 for <[email protected]>; Thu, 04 Jun 2026 02:05:25 -0700 (PDT)

X-Received

by 2002:a05:6820:4df1:b0:69e:3f08:fdae with SMTP id 006d021491bc7-69e480a1d09mr3835299eaf.50.1780563923482; Thu, 04 Jun 2026 02:05:23 -0700 (PDT)

Received-Spf

Pass (protection.outlook.com: domain of gocomet.com designates 2607:f8b0:4864:20::c36 as permitted sender) receiver=protection.outlook.com; client-ip=2607:f8b0:4864:20::c36; helo=mail-oo1-xc36.google.com; pr=C

Message-Id

<CAJ_UWy8pPaaRjsjMNYwViKqvmZVi1FGh2nj3rkCCoiLOwouYWg@mail.gmail.com>