General

  • Target
    Phishing_a46d1651-c91d-4399-5e07-08df17bece37_luis.barrialesporras@evolutio.com_(RE_ [2026-09-21 04_45_40 UTC+02] _ [Alsea] _ SEDR _ Baja _ INC000002411886_411501 - Possible Account Compr.. 09_24_2026 17_02_5.eml
  • Size 97KB
  • Sample260925-gtbe1sbb64
  • SHA256 4d2b605a050aa3a08a1b80557a42a2dbdde36ed0ef274c3d6ee68e52b97c3155
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • Phishing_a46d1651-c91d-4399-5e07-08df17bece37_luis.barrialesporras@evolutio.com_(RE_ [2026-09-21 04_45_40 UTC+02] _ [Alsea] _ SEDR _ Baja _ INC000002411886_411501 - Possible Account Compr.. 09_24_2026 17_02_5.eml
    .eml 97KB
  • attachment-2
    .eml 47KB
  • email-html-2.txt
    .html 21KB
  • email-plain-1.txt
    3KB
  • email-plain-1.txt
    15KB

Phishing_a46d1651-c91d-4399-5e07-08df17bece37_luis.barrialesporras@evolutio.com_(RE_ [2026-09-21 04_45_40 UTC+02] _ [Alsea] _ SEDR _ Baja _ INC000002411886_411501 - Possible Account Compr.. 09_24_2026 17_02_5.eml

  • SHA256 4d2b605a050aa3a08a1b80557a42a2dbdde36ed0ef274c3d6ee68e52b97c3155
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Thu, 24 Sep 2026 17:02:59 +0000

Subject

Phishing:a46d1651-c91d-4399-5e07-08df17bece37|[email protected]|(RE: [2026-09-21 04:45:40 UTC+02] | [Alsea] | SEDR | Baja | INC000002411886/411501 - Possible Account Compr.. 09/24/2026 17:02:59

Content-Type

multipart/mixed; boundary="_002_JMRa46d1651c91d43995e0708df17bece37Phish639258661797603_"

Received

from DB9PR03MB7498.eurprd03.prod.outlook.com (2603:10a6:10:220::19) by DBAPR03MB6661.eurprd03.prod.outlook.com with HTTPS; Thu, 24 Sep 2026 17:03:45 +0000

from DU7P194CA0003.EURP194.PROD.OUTLOOK.COM (2603:10a6:10:553::24) by DB9PR03MB7498.eurprd03.prod.outlook.com (2603:10a6:10:220::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Thu, 24 Sep 2026 17:03:41 +0000

from DB3PEPF0000885A.eurprd02.prod.outlook.com (2603:10a6:10:553:cafe::69) by DU7P194CA0003.outlook.office365.com (2603:10a6:10:553::24) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.18 via Frontend Transport; Thu, 24 Sep 2026 17:03:41 +0000

from nat.eu.perception-point.io (99.80.189.20) by DB3PEPF0000885A.mail.protection.outlook.com (10.167.242.5) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 24 Sep 2026 17:03:40 +0000

from DB3PR08CU002.outbound.protection.outlook.com (mail-db3pr08cu00207.outbound.protection.outlook.com [40.93.64.87]) by inbound-smtp.eu-west-1.amazonaws.com with SMTP id avpmephmv1s15cskl3hreuiiosjblobl68mbp0g1 for [email protected]; Thu, 24 Sep 2026 17:03:33 +0000 (UTC)

from PR1P264CA0154.FRAP264.PROD.OUTLOOK.COM (2603:10a6:102:346::18) by MIYPR03MB11807.eurprd03.prod.outlook.com (2603:10a6:290:78::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Thu, 24 Sep 2026 17:03:03 +0000

from MAD0EPF000008AD.eurprd04.prod.outlook.com (2603:10a6:102:346:cafe::3b) by PR1P264CA0154.outlook.office365.com (2603:10a6:102:346::18) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.18 via Frontend Transport; Thu, 24 Sep 2026 17:03:03 +0000

from OSPPR02CU001.outbound.protection.outlook.com (2a01:111:f403:c20f::7) by MAD0EPF000008AD.mail.protection.outlook.com (2603:10b6:140::1ba) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.451.8 via Frontend Transport; Thu, 24 Sep 2026 17:03:02 +0000

from AS8PR03MB7765.eurprd03.prod.outlook.com (2603:10a6:20b:404::21) by MI3PR03MB11704.eurprd03.prod.outlook.com (2603:10a6:290:73::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Thu, 24 Sep 2026 17:02:59 +0000

from AS8PR03MB7765.eurprd03.prod.outlook.com ([fe80::5f9:46c3:1add:dbed]) by AS8PR03MB7765.eurprd03.prod.outlook.com ([fe80::5f9:46c3:1add:dbed%5]) with mapi id 15.21.0451.014; Thu, 24 Sep 2026 17:02:59 +0000

Received-Spf

Fail (protection.outlook.com: domain of starbucks.cl does not designate 99.80.189.20 as permitted sender) receiver=protection.outlook.com; client-ip=99.80.189.20; helo=nat.eu.perception-point.io;

pass (spfCheck: domain of starbucks.cl designates 40.93.64.87 as permitted sender) client-ip=40.93.64.87; [email protected]; helo=DB3PR08CU002.outbound.protection.outlook.com;

Pass (protection.outlook.com: domain of starbucks.cl designates 2a01:111:f403:c20f::7 as permitted sender) receiver=protection.outlook.com; client-ip=2a01:111:f403:c20f::7; helo=OSPPR02CU001.outbound.protection.outlook.com; pr=C

Message-Id

<JMR.a46d1651-c91d-4399-5e07-08df17bece37.Phish.639258661797603841@microsoft.com>

Extracted URLs

  • file https://eur05.safelinks.protection.outlook.com/?url=