fff7ca8f97c2509c52df6fec01fceeae086934938be99336995202b483f5f249

Sharing

Copy URL Twitter E-mail

General

Target
No. RAD. 47001103216920201326660 _ JUZGADO 1 (PENAL DEL CIRCUITO ESPECIALIZADO) DE SANTA MARTA MAGDALENA 4701995769 COMISIÓN
Size 1.7MB
Sample260708-vtl4eaev5x
SHA256 fff7ca8f97c2509c52df6fec01fceeae086934938be99336995202b483f5f249
MD5 3f43f09641339c95448aa17dbef3d8eb
SHA1 0bc7a9bd0de31cb7c12a603d5482b73128cb89f4
SHA512 5128c84ccd497944bcbef808f88a356a4eb8b53ee226aa3a420b82d29c93c8eb031832f9a8f7ae22cf67b9c65b365e6e87691ed6408880b784c2d0dbbf781ff3
SSDEEP 24576:pc+sufrgD8/ZQcU9MiUj4DeHZhHWBeAchny0kWlxkJlUklx:hlUQs2h2MhlkWlQr
TLSH
T1D5857DF337DF2A475A05376EE40C2A580F6ED0255B83A7E894D74A84181F8DB1AD0DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  No. RAD. 47001103216920201326660 _ JUZGADO 1 (PENAL DEL CIRCUITO ESPECIALIZADO) DE SANTA MARTA MAGDALENA 4701995769 COMISIÓN
- Size 1.7MB
- SHA256 fff7ca8f97c2509c52df6fec01fceeae086934938be99336995202b483f5f249
- MD5 3f43f09641339c95448aa17dbef3d8eb
- SHA1 0bc7a9bd0de31cb7c12a603d5482b73128cb89f4
- SHA512 5128c84ccd497944bcbef808f88a356a4eb8b53ee226aa3a420b82d29c93c8eb031832f9a8f7ae22cf67b9c65b365e6e87691ed6408880b784c2d0dbbf781ff3
- SSDEEP 24576:pc+sufrgD8/ZQcU9MiUj4DeHZhHWBeAchny0kWlxkJlUklx:hlUQs2h2MhlkWlQr
- TLSH
  T1D5857DF337DF2A475A05376EE40C2A580F6ED0255B83A7E894D74A84181F8DB1AD0DAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

adware spyware
behavioral1 behavioral2
- Target
  SHA-Attachment 20240719.xhtml
- Size 1.2MB
- SHA256 78783d1a36be983748c2dbb3ed8ad4f1f256acab2dfa92d40cdbec65d2d215a7
- MD5 807da8f347c96063a6da2700aceab1f1
- SHA1 fb5fac66824b91eeb2a211da146c58167961d393
- SHA512 42155e4a8f32b0509f60ec67e6c36f2bbe9df4d6901392c8de2d7c4fb108c9984952d5b80d15b58964ba2c0bd3271ecd946c33841d35e234442acb95dc020175
- SSDEEP 24576:RvR1uPTHObSFII+wunJcqMnoyZbI5X+r5WOQtby2ZVIi6xXENrHS4xRS6:l6PTHmSFIIH8
- TLSH
  T13845E0BC62042DAE27BE527EFCD31CD51AD51953CA9F90CEC09961C308A36B5FD2B40A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  email-html-2.txt
- Size 13KB
- SHA256 dd5dc474c9542a572e344bb1027829d4f8464ea38f33bf297fda28c260e356d8
- MD5 8c072c053dbc8019ecb13e3b0eb8a707
- SHA1 17d70012b7d929ae308c1362adc8f481800f366e
- SHA512 5202f9e22ad1e64450caab17b1b5e17edcca7547686e8fba04a856df72ba86806a2c235c97ed97c0a73dc0c924a17e6c624b956100ddb79ae35e17b2a427b34f
- SSDEEP 192:Px2PUx2Sx2Bx23Bx2QGx2Hp3Bx27PMAgv:J7BmOTc8p3TRAgv
- TLSH
  T19752D713F3C01D1599AF4920A5433B7E7F3991DA9F224974A9CB3B7E0B4CCD686C2688
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  email-plain-1.txt
- Size 592B
- SHA256 e637317f37601e78974179e115a2b8b9ad29ddeace02f030d80467a0edbe08ee
- MD5 0f6960bfa32e0218609e2beae40b375f
- SHA1 0fa0f3ad10d6703c8c81d1a1beddfe5488086ac1
- SHA512 bc9676206e16581dbbaef2b44cc2b013ad4fe90fd605aa749a32ed396c28b3e053de6d04d2702f48b4495e593eee48401b78d18f3bc48d4db7167fdd184f776c
- TLSH
  T127F041796EC207528AD70200F0CA7F27F0090889E38CE148B1F3478B169C2C4C23EB6C
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8