Resubmissions

10/07/2026, 11:33

260710-npbcsaaw4l4

10/07/2026, 11:28

260710-nlgemaav4p7

General

  • Target
    8298bceb-ef4d-d03f-6fe9-fff1e15da249.eml
  • Size 87KB
  • Sample260710-npbcsaaw4l
  • SHA256 ec191a52c8f3ce358a05faf9c1b9166016694b15f9c03d041e28927088955d05
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • 8298bceb-ef4d-d03f-6fe9-fff1e15da249.eml
    .eml 87KB
  • BL_MAEU3454206O- Bergevessel.html
    .html 1KB
  • email-html-2.txt
    .html 12KB
  • email-plain-1.txt
    2KB

8298bceb-ef4d-d03f-6fe9-fff1e15da249.eml

  • SHA256 ec191a52c8f3ce358a05faf9c1b9166016694b15f9c03d041e28927088955d05
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
M@yIsangPun0NgKamatisNanabaliDahilSabigatng!bon

Email Headers

Return-Path

[email protected]

Date

Tue, 7 Jul 2026 16:05:50 +0800

Subject

=?utf-8?Q?RE:_Arrival_Notification_=E2=80=93_B/L_N?= =?utf-8?Q?o._MAEU4677762O_OB/L_#_DOVUN4223?=

Content-Type

multipart/mixed; boundary="----=_NextPart_000_10FF_01DD0E2A.7B4C0DA0"

Received

from TYCP286CA0233.JPNP286.PROD.OUTLOOK.COM (2603:1096:400:3c7::19) by TYSPR04MB8061.apcprd04.prod.outlook.com (2603:1096:405:87::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.9; Tue, 7 Jul 2026 08:06:36 +0000

from TY2PEPF0000AB8A.apcprd03.prod.outlook.com (2603:1096:400:3c7:cafe::1f) by TYCP286CA0233.outlook.office365.com (2603:1096:400:3c7::19) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.13 via Frontend Transport; Tue, 7 Jul 2026 08:06:36 +0000

from esa1.hc847-16.ap.iphmx.com (139.138.45.217) by TY2PEPF0000AB8A.mail.protection.outlook.com (10.167.253.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.6 via Frontend Transport; Tue, 7 Jul 2026 08:06:36 +0000

from mail-gateway-2.satcloud247.com ([52.30.112.149]) by esa1.hc847-16.ap.iphmx.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Jul 2026 16:06:28 +0800

from [172.30.10.222] (unknown [172.30.10.222]) by mail-gateway-2.satcloud247.com (Halon) with ESMTP id dafab9c0-3a2b-42c5-aa03-9937ced2a59e; Tue, 07 Jul 2026 08:06:25 +0000 (UTC)

from mail-gateway-1.satcloud247.com ([172.30.1.212]) by MGW04-EUWEST1A-InboundFilter-Internal via TCP with ESMTP; Tue, 07 Jul 2026 08:06:14 +0000

from [172.30.10.222] (unknown [172.30.10.222]) by mail-gateway-1.satcloud247.com (Halon) with ESMTP id 9ab7e9b8-104e-47a7-b492-1e8a1a5b6374; Tue, 07 Jul 2026 08:06:13 +0000 (UTC)

from mainhub.bergebulk.navarinoinfinity.com ([45.56.229.215]) by smtp.satcloud247.com via TCP with ESMTPSA; Tue, 07 Jul 2026 08:06:13 +0000

from mainhub.bergebulk.navarinoinfinity.com (localhost [127.0.0.1]) by mainhub.bergebulk.navarinoinfinity.com (Postfix) with ESMTP id 8526E2A66; Tue, 7 Jul 2026 08:06:12 +0000 (UTC)

from mainhub (localhost [127.0.0.1]) by mainhub.bergebulk.navarinoinfinity.com (Postfix) with ESMTP id 872FC2A65; Tue, 7 Jul 2026 08:06:11 +0000 (UTC)

from torre.bergebulk.navarinoinfinity.com (unknown [216.128.4.136]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mainhub.bergebulk.navarinoinfinity.com (Postfix) with ESMTPS id F1E062A50; Tue, 7 Jul 2026 08:06:09 +0000 (UTC)

from torre (localhost [127.0.0.1]) by torre.bergebulk.navarinoinfinity.com (Postfix) with ESMTP id 885215F7BF; Tue, 7 Jul 2026 08:05:50 +0000 (UTC)

from torre.bergebulk.navarinoinfinity.com (localhost [127.0.0.1]) (using TLSv1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by torre.bergebulk.navarinoinfinity.com (Postfix) with ESMTPS id C3C125F438; Tue, 7 Jul 2026 08:05:49 +0000 (UTC)

from torre.bergebulk.navarinoinfinity.com (localhost [127.0.0.1]) by torre.bergebulk.navarinoinfinity.com (Postfix) with ESMTP id 789A88A9CB; Tue, 7 Jul 2026 08:05:49 +0000 (UTC)

from BTEPC01 (BTE-PC01.bergebulk.navarinoinfinity.com [172.25.28.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by torre.bergebulk.navarinoinfinity.com (Postfix) with ESMTPS id E40408A9B5; Tue, 7 Jul 2026 08:05:48 +0000 (UTC)

Received-Spf

Fail (protection.outlook.com: domain of bergevessel.com does not designate 139.138.45.217 as permitted sender) receiver=protection.outlook.com; client-ip=139.138.45.217; helo=esa1.hc847-16.ap.iphmx.com;

Pass (esa1.hc847-16.ap.iphmx.com: domain of [email protected] designates 52.30.112.149 as permitted sender) identity=mailfrom; client-ip=52.30.112.149; receiver=esa1.hc847-16.ap.iphmx.com; envelope-from="[email protected]"; x-sender="[email protected]"; x-conformance=spf_only; x-record-type="v=spf1"; x-record-text="v=spf1 ip4:34.249.46.228/32 ip4:52.50.118.45/32 ip4:54.76.227.115/32 ip4:52.30.112.149/32 ip4:18.185.194.105/32 ip4:18.196.227.37/32 ip4:35.157.169.77/32 ip4:35.158.89.151/32 ip4:54.240.90.171/32 ip4:54.240.90.172/32 ip4:3.255.44.175/32 ip4:52.57.144.30/32 ip4:34.248.210.27/32 ip4:3.125.167.92/32 -all"

X-Mailer

Microsoft Outlook 16.0

Message-Id

<[email protected]>