2026-07-06-13h19m16s-Owr8qQa--3-9-PHISHING Wg_ (ID 1-2SOQ5NZL) Rechnung zu Ihrer BahnCard[.]eml

General

Target
2026-07-06-13h19m16s-Owr8qQa--3-9-PHISHING Wg_ (ID 1-2SOQ5NZL) Rechnung zu Ihrer BahnCard.eml
Size 157KB
Sample260706-nl2esses8y
SHA256 151a331e6ee99f8b93f12feb8bdfbb8bbac13d9c39358ad10baaf9cfac47e79b
MD5 add0c7b2e3b4af18a8787eeddece4a17
SHA1 83bf63e694ecf0ec6a3f8d291420e8aad977890b
SHA512 386f980cf33366d3394222bbffb90a0d1707a721c27343963027a75ace08d958f6f9326d4ca88be8f1e81122db73dc39e2f6b4a45185c87480984219c96180dc
SSDEEP 3072:ZAAHLGeSTl3dbhus4K/1yJidsW51qLasrxipfBfs43lHQH6JLX:+AVE5hus0C1kvxCZeiLX
TLSH
T145F301109D071DE22B749A9FE3CD7DE4652CF70E48A350B4F1A1A38863B46F422D4DE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-06-13h19m16s-Owr8qQa--3-9-PHISHING Wg_ (ID 1-2SOQ5NZL) Rechnung zu Ihrer BahnCard.eml

.eml 157KB
email-html-1.txt

5KB

2026-07-06-13h19m16s-Owr8qQa--3-9-PHISHING Wg_ (ID 1-2SOQ5NZL) Rechnung zu Ihrer BahnCard.eml

SHA256 151a331e6ee99f8b93f12feb8bdfbb8bbac13d9c39358ad10baaf9cfac47e79b
MD5 add0c7b2e3b4af18a8787eeddece4a17
SHA1 83bf63e694ecf0ec6a3f8d291420e8aad977890b
SHA512 386f980cf33366d3394222bbffb90a0d1707a721c27343963027a75ace08d958f6f9326d4ca88be8f1e81122db73dc39e2f6b4a45185c87480984219c96180dc
SSDEEP 3072:ZAAHLGeSTl3dbhus4K/1yJidsW51qLasrxipfBfs43lHQH6JLX:+AVE5hus0C1kvxCZeiLX
TLSH
T145F301109D071DE22B749A9FE3CD7DE4652CF70E48A350B4F1A1A38863B46F422D4DE9
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Date

Mon, 6 Jul 2026 11:19:15 +0000

Subject

=?UTF-8?Q?PHISHING_Wg=3A=C2=A0=28ID_1-2SOQ5NZL?= =?UTF-8?Q?=29_Rechnung_zu_Ihrer_BahnCard?=

Content-Type

multipart/related; boundary="------------79Bu5A16qPEYcVIZL@tutanota"

Received

from mail.w11.tutanota.de ([fd:ac:0:0:0:0:e:11]) by tutadb.w10.tutanota.de with SMTP (SubEthaSMTP 3.1.7) id MR94NGSW for [email protected]; Mon, 06 Jul 2026 13:19:16 +0200 (CEST)

from mout.web.de (mout.web.de [212.227.15.4]) by mail.w11.tutanota.de (Postfix) with ESMTPS id 7CC7522AB48B7 for <[email protected]>; Mon, 6 Jul 2026 13:19:16 +0200 (CEST)

from [88.130.172.64] ([88.130.172.64]) by trinity-msg-rest-webde-webde-live-584767dd64-ssv2z (via HTTP); Mon, 6 Jul 2026 11:19:15 +0000

Received-Spf

Pass (mailfrom) identity=mailfrom; client-ip=212.227.15.4; helo=mout.web.de; [email protected]; receiver=tutamail.com

Message-Id

<trinity-1b482a41-50d3-43fc-8706-f055c04cc4f9-1783336755827@trinity-msg-rest-webde-webde-live-584767dd64-ssv2z>

Extracted URLs

file http://bahn.de
file http://deutschebahn.com
file http://www.bahn.de/hilfe.
file https://www.db-fernverkehr.com/datenschutzhinweise
file https://www.db-fernverkehr.com/datenschutzhinweise/datenschutz-bahncard

Sharing