Extracted

• • Target
    Notificación Judicial_ AUDIENCIA DE FORMULACIÓN DE ACUSACIÓN · 9100702961; OFICINA_ 2° JUZGADO PENAL DEL CIRCUITO DE LETICIA EXPEDIENTE 91001738515720268905304 · LETICIA - AMAZONAS.msg
  • Size 10.1MB
  • SHA256 cc25a6ed5a2e8df58e63c0df8f6b99e8816b81a1da57ddfd1c446d3899c75c19
  • MD5 026039d7f19c3a2ee18d09ca771a45cc
  • SHA1 b25f633d7b89e83ba9d3aa17e73ad14bd565007a
  • SHA512 0e5a627209fd78c4ea5ba51fdc4bd2d5435e093c94ab7bb485171852546baeaf91fafc2359ce60a46be08c4edcc7574bcffc66c8b74fe665546c5cebe7687560
  • SSDEEP 49152:ShojDXGIXiSzeR0tCb5Ted5CkXSLPV7A6ziYAslpIUNogdEMpy1kDYotK2zBfiSM:S4
  • TLSH
    T106B63AB337EF768F29093359A44E2A8C0F5ED4601EC3E7D481DB06D8540F45A6AD4AAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10

  adwarespyware
  behavioral1behavioral2
• • Target
    (7) QUERELLA.Registraduria_2706 COM.c363b3a.xhtml
  • Size 7.4MB
  • SHA256 9c193399bf36bf6dcfbc4e2577e696d2ab1e7ba64a46e6ffa3735689bae2fb1c
  • MD5 33a6577a093c056efd92335dceb6c63e
  • SHA1 b53111224f9573847486d443e8435262afa39aaa
  • SHA512 9d3fac8deb573f4960d02e00109ab06b4a9a463faea6a7730446b8535c1dbe0d3f584e09d91f8933b86bfb99a67570511c4311ad2dd7b93a465cbc1a4a289c79
  • SSDEEP 24576:mm1LWdVHNjC7nvSUVsTe8XprmzsO4cOwupN8NodBox5qdS9T9oNKUypoD0INYpKh:7e9M7K7G2n
  • TLSH
    T124769EFC2614BCE12A6E5B93DDA4BDDD07761673DA8AA8CD411036C206B337BFE05885
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionevolutionratpersistenceprivilege_escalationransomwarerat

  • Family: EvolutionRAT

    EvolutionRAT is a Windows RAT written in C.

    ratevolutionrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Deletes itself

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    email-html-2.txt
  • Size 1KB
  • SHA256 b348d9c31fe49dde4fd91e5d6fdef28be3f5189eead31779e6400f146aaee7d2
  • MD5 7df04a0726c93869c4b8f1787eeb890c
  • SHA1 e1fbc280d63ac12f674e6a14866948a7cbb3f77e
  • SHA512 380135b86ebe28595a6e5e491564c6047307fbed15f7b95a4c13aa29e165391056adf0e6f0eb64e8c8de0d45189a7b0174c3a2fa40a89b9d64cefc6efc6ac8ef
  • TLSH
    T15A31426704D00F4AA5A34730E003E797C6491682F15F812123A3977781CE719EBF369A
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6