Extracted

• • Target
    Oficio 041249 53435 2026 00 04545ufdf/Oficio_041249_Confirmar_recibido_00564.js
  • Size 23.4MB
  • SHA256 71144cab62cbb9df2e994cf320eab5563429ba993cc8fd2cb3e5254028c6433c
  • MD5 8b4b8144cd0f06447287cff8c1d6405a
  • SHA1 d04be276d1e9365eb762904e65ee1775d6667a71
  • SHA512 861cb65c01ef6ae5f6cde133dd2320e016d41444d3d0081aab610ed6746227becc97eec5bac2dd679461c6dacfa66bb1e86f5bb949308e8eadab11f812885558
  • SSDEEP 768:ul7C9Rlg1DfjGKDIExP2C1xRUNqJ80gTFu7V3Cqo2eC+9EWWSuRoPqpPQgzQtgCo:75Z5O
  • TLSH
    T16C37586462D3F04C3745F8B1538FC9B29AAFBC46731B5638A41927781AE060EF86F15E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  julio 20discoveryexecutionasyncratpersistencerat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    Oficio 041249 53435 2026 00 04545ufdf/WinSupport PackagesWinrar/ChromeSetup.exe
  • Size 11.2MB
  • SHA256 fd0e05fe583546af3d9aa0181f9251e87a42b3e3bec84d09c7e28fdc21d25dd1
  • MD5 34854362e4f8d3c4def2eb91cbe5d2e5
  • SHA1 d9f65674000697ae73e90bbea135e0208eef4bbb
  • SHA512 2671c3545cad442487fb509f9c574cf5f0df384652fb9ed01a163d56feecd4af1fa5812abd878096d2b891c3d1a0fba3c148af8cb15ef70d2e2f440861102805
  • SSDEEP 196608:wR2dqCK8GiLKsq+YpWhTlilBVg3+yIg3KuyFdDEbBLFpl3VACH69XKVHwliByrc8:wR2QCPLKsq+YpWhTlilBS+y161FdDEb2
  • TLSH
    T1ADC69D13B5A0A174E4A73231F43D67394D323E62AB3585CF86906CC86FB86D2653A35F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  defense_evasiondiscoverypersistenceprivilege_escalationspywarestealertrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral3
• • Target
    Oficio 041249 53435 2026 00 04545ufdf/WinSupport PackagesWinrar/decompService.exe
  • Size 696KB
  • SHA256 07a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff
  • MD5 d882650163a8f79c52e48aa9035bacbb
  • SHA1 9518c39c71af3cc77d7bbb1381160497778c3429
  • SHA512 8f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1
  • SSDEEP 12288:6MtfzQzoQx2zjZfptd3nvsp1Y4r39f0RjMxkyDpZ7:6YzE2RdvK1/r39kqDj7
  • TLSH
    T176E41A69F5748331D073C0BAC4D2AA9AEE7230425B308ACB1246D76D3E677D6D63A731
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral4behavioral5
• • Target
    Oficio 041249 53435 2026 00 04545ufdf/WinSupport PackagesWinrar/helpViewer.exe
  • Size 18KB
  • SHA256 eb63fd45ed7ec773eccaf0f20d44bc9b4ed0a3e01779d62321b1da954a0f6eb8
  • MD5 2c8fe78d53c8ca27523a71dfd2938241
  • SHA1 0111959e0f521d0c01d258abbb42bba9c23e407d
  • SHA512 4fba46ecc4f12bae5f4c46d4d6136bb0babf1abf7327e5210d1291d786ce2262473212a64da35114776b1ce26ead734a9fd3972ffa0f294d97ab6907953fd137
  • SSDEEP 192:U8kHEFbfhORz4NqRGQE7KpcPUKU/dlk06Sl0+m5GJ1KDJD/QWc7:U8kH67heMMRGQEOpR/dlk06I1KDuWc7
  • TLSH
    T11782A405B6A88885E0B9463289A34A144930BC226B510BEF35D4776F3F337D7F937AD9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral6
• • Target
    Oficio 041249 53435 2026 00 04545ufdf/WinSupport PackagesWinrar/reportView.exe
  • Size 11KB
  • SHA256 a70d52eda892edc073932b462cc367cdbfbace3f4196857d8d4fa869a13de792
  • MD5 b947cca7f485f6c1156f4d02e8c9874f
  • SHA1 9f184e48f17f104c6a476687e8e760a65a0326b5
  • SHA512 28c6ff32bc94aad8b201e469f854dde32cad9eb2e7a80ed858ac2ff99648312cecca06918bce96e8d905d52d5ebee076bd08d957f7933602c0c79d93ead20ee3
  • SSDEEP 192:ZV89t7hglDCS8O3GbXdYFWihWxu/sWGOW:ZVM7hceSP3IXioxu/sWGOW
  • TLSH
    T12332C941A75989AAF03E42F588634A49B5747E220B1157FF3198F21E1F32BC7AE3169C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral7