fb3fc30dab39898ea8ed66d8b14c1623b4878b632e225e0695dfd384febc46e8

Sharing

Copy URL Twitter E-mail

General

Target
Ref. Proceso 88001606815820252701921 _ Comisión _ Dependencia_ Juzgado 002 Penal Cto. Fn. Conoc. De San Andrés. De San Andrés
Size 10.0MB
Sample260707-rymc7agt3m
SHA256 fb3fc30dab39898ea8ed66d8b14c1623b4878b632e225e0695dfd384febc46e8
MD5 ff36ee24d750b8b390bf34835d594c0b
SHA1 c6d98c15326225056f62ddcbb82b014aab082404
SHA512 e0c0d0f155ef9493cf72323f23fc29a6d2d2f43e14460b6c70fb49a1e6a2c634d1120a77937a6c8e60a6722e62450ca95f343a15dd6fd39c18e27b5981e680e5
SSDEEP 49152:9GQ415gEFwVb5uLnGboePPXXH6ywWy+aErIJsp+gs9GDBeEXsVp/8nh7cW7m3hUu:s
TLSH
T14EB609F337DE190F29157256E40D7A890BADD9350EC2B7E4E5D70A88180F4CBAA90D9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Ref. Proceso 88001606815820252701921 _ Comisión _ Dependencia_ Juzgado 002 Penal Cto. Fn. Conoc. De San Andrés. De San Andrés
- Size 10.0MB
- SHA256 fb3fc30dab39898ea8ed66d8b14c1623b4878b632e225e0695dfd384febc46e8
- MD5 ff36ee24d750b8b390bf34835d594c0b
- SHA1 c6d98c15326225056f62ddcbb82b014aab082404
- SHA512 e0c0d0f155ef9493cf72323f23fc29a6d2d2f43e14460b6c70fb49a1e6a2c634d1120a77937a6c8e60a6722e62450ca95f343a15dd6fd39c18e27b5981e680e5
- SSDEEP 49152:9GQ415gEFwVb5uLnGboePPXXH6ywWy+aErIJsp+gs9GDBeEXsVp/8nh7cW7m3hUu:s
- TLSH
  T14EB609F337DE190F29157256E40D7A890BADD9350EC2B7E4E5D70A88180F4CBAA90D9F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware spyware persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Fwd sentencia-09-2023.xhtml
- Size 7.3MB
- SHA256 eafbfca47efebd36e0026070e107dfd9494ce704725477898d2bb05d58a1e7b4
- MD5 e2b378a078e5f98b1e39da98ab0a16d9
- SHA1 d5b5d29a243400d04d50e182c21451ed93a246c4
- SHA512 31aad155ea3fbe26cd7288bb89d63c1e93571217ad313e5ef0b4254c2d959edcf1110ab22c28ee18c85112c98aaa2d7e56ad76216c4b9922a8be12d35b14b671
- SSDEEP 24576:+vR1uPTHObSFII+wunJclyWKtwJolhmJ9hI6pEGKes6l4kZnip6zU0E2F3K+/IRK:g6PTHmSFIIHB
- TLSH
  T1E276AEF83A043CD1B65F177BDA66ADEC137526B6768B68CC4150BBC214637A6EF01C0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence ransomware
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  email-html-2.txt
- Size 1KB
- SHA256 2df30a05be3e99ff946462218d8a3103b2e116ed8e970378e0fd288a61026a13
- MD5 53a2d06ed337f2ea7dcec6ce1295a4ca
- SHA1 5b66fcbfe394e398bd50cde8d3f6b2d2412e7436
- SHA512 403bf66333c7445bef3272743ec683b229801a151ecedd9f2427d02949be5645c42adcf3a089f2669d20f14c41b97e6e3dfc7accd985c0dc473bd7f965f9356f
- TLSH
  T1CF3162F145C01D0458E34238F847AB57D6CC28C2731AD16874E605675ACD689C7BFAE5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  email-plain-1.txt
- Size 1KB
- SHA256 9b910710350471fcc3c61602e7c7d2d7059e55efe67863cfebcf09779bf59d4a
- MD5 b34146fc977d004d6609585672829837
- SHA1 b16c4db7c3cd917e8298cf333ec311a9a12be4cb
- SHA512 20f951e8ecd955bcc53ad42e22d11d8397b332312d474b89de46cfa5ad3af1090134dea67ba063b43c8a9fba41e59ceea664a87106361803818d9faeca6c3781
- TLSH
  T1E22163358AC41E0018D35145F902AA53E8CC48D2770ED04E74EA0A2F66CDBC9C16FAAE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8