_SUSPECTED SPAM_ ATENCIÓN_ ¡¡¡Notificación de error del servidor de Gsi!!![.]msg

Sharing

Copy URL Twitter E-mail

General

Target
_SUSPECTED SPAM_ ATENCIÓN_ ¡¡¡Notificación de error del servidor de Gsi!!!.msg
Size 1.4MB
Sample260910-rfp2csysgw
SHA256 4099bd3f8dcc80c7e0984da18ebf61f3901525816a63cf542488d259cd69d10a
MD5 04f85b5393a9797d1809a1026d1e948d
SHA1 7d39119e2a3a93894359a7b372ebcf3ea7de8dfb
SHA512 481ab58153a7c44f53555003c38cfe0a99b88b1d82f747f7ad2d51f9551d207fb274e1e5031958e0434081594320192e3c4dd7151e123ee1118151a8cc8125e3
SSDEEP 24576:ZWBk2TD8+xuGPP0sg6t/V19nR+RIsI6lCUxSQP7ADTxtL3liJ48BYsh84AWsT2f9:iYWLPP/dVJGIsI6lCqLUDTxDoGsi4AW0
TLSH
T132652324BCD68749F57B7A351AD6C07B472A6CC2EF148A1B314C730A1732F14A993F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

_SUSPECTED SPAM_ ATENCIÓN_ ¡¡¡Notificación de error del servidor de Gsi!!!.msg

.msg 1.4MB
6tbMsEzufI3NgRapMqnNl4c2.png

.png 26KB
image.png

.png 1.4MB

_SUSPECTED SPAM_ ATENCIÓN_ ¡¡¡Notificación de error del servidor de Gsi!!!.msg

SHA256 4099bd3f8dcc80c7e0984da18ebf61f3901525816a63cf542488d259cd69d10a
MD5 04f85b5393a9797d1809a1026d1e948d
SHA1 7d39119e2a3a93894359a7b372ebcf3ea7de8dfb
SHA512 481ab58153a7c44f53555003c38cfe0a99b88b1d82f747f7ad2d51f9551d207fb274e1e5031958e0434081594320192e3c4dd7151e123ee1118151a8cc8125e3
SSDEEP 24576:ZWBk2TD8+xuGPP0sg6t/V19nR+RIsI6lCUxSQP7ADTxtL3liJ48BYsh84AWsT2f9:iYWLPP/dVJGIsI6lCqLUDTxDoGsi4AW0
TLSH
T132652324BCD68749F57B7A351AD6C07B472A6CC2EF148A1B314C730A1732F14A993F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

[email protected]

From

[email protected]

Return-Path

<[email protected]>

Date

Mon, 07 Sep 2026 00:33:49 -0700 (PDT)

Subject

=?utf-8?Q?[SUSPECTED_SPAM]_ATENCI=C3=93N:_=C2=A1=C2=A1=C2=A1Notific?= =?utf-8?Q?aci=C3=B3n_de_error_del_servidor_de_Gsi!!!?=

Content-Type

multipart/related; boundary="===============2007756959781030154=="

Received

from mta2.gsi.com.mx (LHLO mta2.gsi.com.mx) (172.20.20.12) by mbox2.gsi.com.mx with LMTP; Mon, 7 Sep 2026 01:33:59 -0600 (CST)

from cd-use2.prod.hydra.sophos.com (cd-use2.prod.hydra.sophos.com [103.246.251.136]) by mta2.gsi.com.mx (Postfix) with ESMTPS id E4756C4AA7D3 for <[email protected]>; Mon, 7 Sep 2026 01:33:58 -0600 (CST)

from localhost (ip-172-21-2-22.us-east-2.compute.internal [127.0.0.1]) by cd-use2.prod.hydra.sophos.com (Postfix) with ESMTP id 4hdf2Y6fJgzwP5F for <[email protected]>; Mon, 07 Sep 2026 07:33:57 +0000 (UTC)

from mail-pj1-f104.google.com (mail-pj1-f104.google.com [209.85.216.104]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-01-us-east-2.prod.hydra.sophos.com (Postfix) with ESMTPS id 4hdf2R1Xb3zCqjM for <[email protected]>; Mon, 07 Sep 2026 07:33:50 +0000 (UTC)

by mail-pj1-f104.google.com with SMTP id 98e67ed59e1d1-39b2ad862bdso3466135a91.2 for <[email protected]>; Mon, 07 Sep 2026 00:33:50 -0700 (PDT)

from 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa ([189.139.160.84]) by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-39b2610af72sm6479039a91.5.2026.09.07.00.33.46 for <[email protected]> (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 07 Sep 2026 00:33:49 -0700 (PDT)

X-Received

by 2002:a17:90a:1c81:b0:39b:3109:10ce with SMTP id 98e67ed59e1d1-39b310914e0mr18764910a91.16.1788766429376; Mon, 07 Sep 2026 00:33:49 -0700 (PDT)

Received-Spf

pass receiver=mx-01-us-east-2.prod.hydra.sophos.com; client-ip=209.85.216.104; envelope-from=<[email protected]>; helo=mail-pj1-f104.google.com;

Message-Id