e28b308ae061a5182e74cadf8a69a0d33a78db2574eff7fef3fde3221728fe5f

Sharing

Copy URL Twitter E-mail

General

Target
11001209802920202311385 _ Traslado De Excepciones.eml
Size 10.0MB
Sample260708-xt1mxaft6q
SHA256 e28b308ae061a5182e74cadf8a69a0d33a78db2574eff7fef3fde3221728fe5f
MD5 51365b661a1411668a89726e719fa42a
SHA1 1a3176074937a107cd7bffadfc4743c2a2555dde
SHA512 7f96414e5bbe277f04415752dc87a53cd12834ad7616fccabeb78b411bdefd0699e5c43ee728f700689384942e2c085a3a26a7b9c5208aa6af4a42775db97260
SSDEEP 49152:MXF1IdoSJpEJ3UPJmK8aSehxQnyo3NgbuFC0ljI3iweRaVQYfkhgFOmky44/3ApF:MJ
TLSH
T174B60AA337EF690F29253799680D7D980FAED0211EC2A7E4D4CB0BD4540F84B6E91D6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  11001209802920202311385 _ Traslado De Excepciones.eml
- Size 10.0MB
- SHA256 e28b308ae061a5182e74cadf8a69a0d33a78db2574eff7fef3fde3221728fe5f
- MD5 51365b661a1411668a89726e719fa42a
- SHA1 1a3176074937a107cd7bffadfc4743c2a2555dde
- SHA512 7f96414e5bbe277f04415752dc87a53cd12834ad7616fccabeb78b411bdefd0699e5c43ee728f700689384942e2c085a3a26a7b9c5208aa6af4a42775db97260
- SSDEEP 49152:MXF1IdoSJpEJ3UPJmK8aSehxQnyo3NgbuFC0ljI3iweRaVQYfkhgFOmky44/3ApF:MJ
- TLSH
  T174B60AA337EF690F29253799680D7D980FAED0211EC2A7E4D4CB0BD4540F84B6E91D6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware spyware persistence ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Defensoria 941161_invima Directiva-Verbal.xhtml
- Size 7.3MB
- SHA256 9270822ada1b7f767d45982e6931e3dacb9c6d19c73b877f1520328405d7afc0
- MD5 1cceb1b895fc4b3e36ccb9b07a12c846
- SHA1 02f029a60f2a5bb49f0ccea4fbb54f5f60a085c2
- SHA512 b4477436b9b3748d1dd54ebac6d2e3eba119013c4ed5ad2fb8adbb9470f7d1889e97fe95ffea5202e51089e47474f44028fb6b1db7225a95da1f39c593789e78
- SSDEEP 24576:hvR1uPTHObSFII+wunJcossshWv5JTUqF7KXLursUfy72Hk6ESfmXYDQBn5LzD0D:16PTHmSFIIHk
- TLSH
  T16976AFF875042DE277AF066BD5AA9EDC437427339A8BA4C94054B7C71AA3726FE07C04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  email-html-2.txt
- Size 1KB
- SHA256 6b9796991f542ac6073d47ae01da615625dec87981bb12395dbd0c8b4d848e19
- MD5 6e9706c23a00c7050ac22c9df08a2230
- SHA1 83655ec2f2260256045f7fd886cf93ad7cee4354
- SHA512 17acd28448e8f5ecaf4c83af8e0b7a865719ca58306bc15f872ecfab71f2e8f3f5911ad94bd9d3496da42ad94297e2dd3e64aae508e22777bcfc90555259460a
- TLSH
  T1503162E2D5811E0CC4F3C3B8E113DB7BD2806144A307456263AB73376A8E688CDB75D9
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  email-plain-1.txt
- Size 872B
- SHA256 0b323dc1bb39cf68651337fc3a293d8bb584d5c0fcfe76577a6ac12ca15bdafc
- MD5 40a9b28e770bc1b7cb2ec44e6327bff7
- SHA1 8ab91e85ed23076c4b7cac77b3d1a466222483c6
- SHA512 ffb953963c066b800a100b687b00207da97dceac5f77b237dd5dbd0122c7b2b6e73b43595a4de167e080392af4b74cc65d0a3845571ba25d3c66c40d5031bc36
- TLSH
  T17D110CA99CCB0B8015D3D3C5A207CE37C0804095AA898163339F232A088EACDC96B89D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8