Overview

overview

3

Static

static

1

REF 25071 COVOS.eml

windows10-2004-x64

3

REF 25071 COVOS.eml

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    REF 25071 COVOS.eml
  • Size 9KB
  • Sample261102-mvy6csbs9l
  • SHA256 97aabacd2937440efa2dc1176bc31dced2fbca3ae8cdd6a1a72c63f8d30be247
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • REF 25071 COVOS.eml
    .eml 9KB
  • email-html-2.txt
    .html 2KB
  • email-plain-1.txt
    1KB

REF 25071 COVOS.eml

  • SHA256 97aabacd2937440efa2dc1176bc31dced2fbca3ae8cdd6a1a72c63f8d30be247
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Date

Sat, 31 Oct 2026 17:28:20 +0000

Subject

REF 25071 COVOS

Content-Type

multipart/alternative; boundary="_000_20261031182819P5UH2J0090tYf5e015UKRmxaviertelenetopsbe_"

Received

from svrexch05-VM.AGGLO-DIJON.AD (10.10.5.5) by svrexch04-VM.AGGLO-DIJON.AD (10.10.5.4) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.61 via Mailbox Transport; Sat, 31 Oct 2026 23:43:02 +0100

from svrexch04-VM.AGGLO-DIJON.AD (10.10.5.4) by svrexch05-vm.AGGLO-DIJON.AD (10.10.5.5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.61; Sat, 31 Oct 2026 18:28:32 +0100

from hsmx01-hz12.hornetsecurity.com (10.0.2.106) by svrexch04-VM.AGGLO-DIJON.AD (10.10.5.4) with Microsoft SMTP Server id 15.1.2507.61 via Frontend Transport; Sat, 31 Oct 2026 18:28:32 +0100

from xavier.telenet-ops.be (195.130.132.52) by mx-gate114-hz12; Sat, 31 Oct 2026 18:28:31 +0100

from DESKTOP-KRBEN0N ([194.146.92.41]) by xavier.telenet-ops.be with cmsmtp id P5UH2J0090tYf5e015UKRm; Sat, 31 Oct 2026 18:28:19 +0100

Message-Id

<[email protected]>

Extracted URLs

  • file https://atpscan.global.hornetsecurity.com?d=Pr3TsTS_sBQTOIHMm5ClsAE9gPEFXRT_gabhUN5lmX4&f=qls_gFf9YYLF2C450ER5ws7XXlN0smQwFh1SWvGW8R2QUfoUPt8AkoN2Xg9eEcfS&i=&k=QKj5&m=PuON2q7Km547kSQ_I2bkHWhD_YHTyAaO4KjgQ4i6tlGj2J3LIZbvePY-U5unfpDXh64sB-LI4AJEzbJMCgkelMH5cOuL_gjMnXpbw8LDdnR2XvyJgBtO6C6kwvNyz2bV&n=SpIFUqKA_4CXD1pL3oDyaQpqOERb5GfGowTbB1rAiw7b1_rjUnX16Qbk9eNrvl8d&r=uzwoleJVwg703pj9ddgPd4D4HGBdKoaUAAIt6cwwoHY&s=6d74b2306d2e094d3f80f2abba48a62347ae98b9ee20e536bbabea34a812c39d&u=

  • file https://atpscan.global.hornetsecurity.com?d=Pr3TsTS_sBQTOIHMm5ClsAE9gPEFXRT_gabhUN5lmX4&f=qls_gFf9YYLF2C450ER5ws7XXlN0smQwFh1SWvGW8R2QUfoUPt8AkoN2Xg9eEcfS&i=&k=QKj5&m=PuON2q7Km547kSQ_I2bkHWhD_YHTyAaO4KjgQ4i6tlGj2J3LIZbvePY-U5unfpDXh64sB-LI4AJEzbJMCgkelMH5cOuL_gjMnXpbw8LDdnR2XvyJgBtO6C6kwvNyz2bV&n=SpIFUqKA_4CXD1pL3oDyaQpqOERb5GfGowTbB1rAiw7b1_rjUnX16Qbk9eNrvl8d&r=uzwoleJVwg703pj9ddgPd4D4HGBdKoaUAAIt6cwwoHY&s=6d74b2306d2e094d3f80f2abba48a62347ae98b9ee20e536bbabea34a812c39d&u=https%3A%2F%2Fshorturl.asia%2Fvh2kgt