f7be721bcc82d0bb76fb1929ae591bdfa9a946f7b62cf0aa769d65db22b525d1

General

Target
41551159309320180996697 _ AUDIENCIA De Legalización De Captura _ 01 Juzgado Penal Mpal. Con Fn. De Conocimiento De Pitalito.eml
Size 10.1MB
Sample260820-xp3lpsfc98
SHA256 f7be721bcc82d0bb76fb1929ae591bdfa9a946f7b62cf0aa769d65db22b525d1
MD5 2bba0785192ca61a77ea604126047a87
SHA1 3c185d325026c2e6eff4172fb06002e04445e341
SHA512 1abfe404204887d3cde473218235b521efd6bb309efdd76f824a26726e00c71f5268f25fc3676aab8b2cf71716656d0e0a59e08826fb0ebefe0aa2657a42123f
SSDEEP 49152:tt/bgABksNoAOOcHBvuCPnhN4kmO14Hmo0pFYHdBBUlmoI42H9JNWjF2ofPWbIs1:p
TLSH
T1B6B639E333DF264B6909776AA44D295C0F5ED4211E83EBD890DB0AD8540F48E66C4EBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  41551159309320180996697 _ AUDIENCIA De Legalización De Captura _ 01 Juzgado Penal Mpal. Con Fn. De Conocimiento De Pitalito.eml
- Size 10.1MB
- SHA256 f7be721bcc82d0bb76fb1929ae591bdfa9a946f7b62cf0aa769d65db22b525d1
- MD5 2bba0785192ca61a77ea604126047a87
- SHA1 3c185d325026c2e6eff4172fb06002e04445e341
- SHA512 1abfe404204887d3cde473218235b521efd6bb309efdd76f824a26726e00c71f5268f25fc3676aab8b2cf71716656d0e0a59e08826fb0ebefe0aa2657a42123f
- SSDEEP 49152:tt/bgABksNoAOOcHBvuCPnhN4kmO14Hmo0pFYHdBBUlmoI42H9JNWjF2ofPWbIs1:p
- TLSH
  T1B6B639E333DF264B6909776AA44D295C0F5ED4211E83EBD890DB0AD8540F48E66C4EBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

adware spyware
behavioral1 behavioral2
- Target
  Fwd BOL125 Auto.POPAYAN 12-183.xhtml
- Size 7.4MB
- SHA256 dbc7fa1086aac7c184a3dbe3a8b2ca6695f34fb1f0332157e473a1fb88df21de
- MD5 8fd5f8abdb8783f33a864a64e1699c1e
- SHA1 6a8692151d80b33549b41372638035060774d43f
- SHA512 c9d7589d918e48fb63c03858b50ffd214219a71bc86a2c214c5909f8c30b4e945ffa2a18d0dc4dbd2a05957dc8da22336df0de4b2f49d14e09a96bc0d45bbba6
- SSDEEP 24576:zJRm1LWdVHNjC7nvSUVsTe8XprmzsO4cOwubAxVfLGl44YCnfOKOwNwMbU1fhQkI:ce9M7K7G52
- TLSH
  T1FA769EB875487CA25A9F17AFCAD67CEA53A712736B8759CD403876C30923336EF06844
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution persistence privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Deletes itself
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of SetThreadContext
behavioral3 behavioral4