Was This Your Login-[.]eml

General

Target
Was This Your Login-.eml
Size 21KB
Sample260924-ranlcaeg39
SHA256 0d56fd8aa5988ffec61e7e5aebd1b2ef3d5fce1278ae559b7fcad0f1c828dec1
MD5 d9684d8d85ae4bb1ba40782e8a7b702b
SHA1 2c54366e614a4b985eef3999367e34716a4540e5
SHA512 90d77083a674b52bbe494d0064825cd4f35602a020d3d05a3596801c85b56268d2bc2c22e2d59e53b55ba2cdf9401eb9dfb7db2d2ae005709afcdfddb442c48e
SSDEEP 384:oDFV7lOsXPWcuv/Rk68WYVuCtOK+k4HHPVN:oDFRlO4Mvpk6PE4Rp/
TLSH
T1A9A25C2203050936EAB501BAAC117E1861A1B845A47B4490FD5F327B1BCF1BC7F73B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Was This Your Login-.eml

.eml 21KB
email-html-2.txt

.html 4KB
email-plain-1.txt

1KB

Was This Your Login-.eml

SHA256 0d56fd8aa5988ffec61e7e5aebd1b2ef3d5fce1278ae559b7fcad0f1c828dec1
MD5 d9684d8d85ae4bb1ba40782e8a7b702b
SHA1 2c54366e614a4b985eef3999367e34716a4540e5
SHA512 90d77083a674b52bbe494d0064825cd4f35602a020d3d05a3596801c85b56268d2bc2c22e2d59e53b55ba2cdf9401eb9dfb7db2d2ae005709afcdfddb442c48e
SSDEEP 384:oDFV7lOsXPWcuv/Rk68WYVuCtOK+k4HHPVN:oDFRlO4Mvpk6PE4Rp/
TLSH
T1A9A25C2203050936EAB501BAAC117E1861A1B845A47B4490FD5F327B1BCF1BC7F73B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

To

[email protected]

From

[email protected]

Return-Path

bounces+[email protected]

Date

Thu, 24 Sep 2026 11:51:48 +0000 (UTC)

Subject

Was This Your Login?

Content-Type

multipart/alternative; boundary=b581a86f8980cba36accc7abbc6790f208513a9d66b0819be7782b6f1d68

Received

from SA0PR04MB7145.namprd04.prod.outlook.com (2603:10b6:806:db::12) by DM8PR04MB8101.namprd04.prod.outlook.com with HTTPS; Thu, 24 Sep 2026 11:52:43 +0000

from BN9PR03CA0294.namprd03.prod.outlook.com (2603:10b6:408:f5::29) by SA0PR04MB7145.namprd04.prod.outlook.com (2603:10b6:806:db::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Thu, 24 Sep 2026 11:51:55 +0000

from LV8PEPF0000006C.namprd03.prod.outlook.com (2603:10b6:408:f5:cafe::34) by BN9PR03CA0294.outlook.office365.com (2603:10b6:408:f5::29) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.16 via Frontend Transport; Thu, 24 Sep 2026 11:51:55 +0000

from us-smtp-inbound-delivery-1.mimecast.com (170.10.128.81) by LV8PEPF0000006C.mail.protection.outlook.com (10.167.248.36) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 24 Sep 2026 11:51:55 +0000

from s.wfbtzbpn.outbound-mail.sendgrid.net (s.wfbtzbpn.outbound-mail.sendgrid.net [159.183.235.50]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-5-4yZzPBMTOGKnvc3jtC-ucg-1; Thu, 24 Sep 2026 07:51:50 -0400

by recvd-d869bbdbb-rlb8v with SMTP id recvd-d869bbdbb-rlb8v-1-6AB50ED4-43 2026-09-24 11:51:48.901196579 +0000 UTC m=+52531.266458581

from NDYzMjM3MjM (unknown) by geopod-ismtpd-17 (SG) with HTTP id tI6UgHnYQ4aPbpfQu59oQQ Thu, 24 Sep 2026 11:51:48.838 +0000 (UTC)

Received-Spf

SoftFail (protection.outlook.com: domain of transitioning em7940.inspectmind.ai discourages use of 170.10.128.81 as permitted sender)

Message-Id

<tI6UgHnYQ4aPbpfQu59oQQ@geopod-ismtpd-17>

Extracted URLs

file https://inspectmind.ai/unsubscribe?email=dbergunder%40iccsafe.org
file https://url.us.m.mimecastprotect.com/s/j1y_CJ6RJLSyLNNNtGh33iyPjuP?domain=inspectmind.ai

Sharing