Extracted

• • Target
    CONTESTACIÓN SEDE JUZGADO 1 PENAL MUNICIPAL CON FUNCIÓN DE CONOCIMIENTO DE RIOHACHA -- 4400513274 No. EXPEDIENTE 44001230100220246220002 - RIOHACHA - LA GUAJIRA.msg
  • Size 7.1MB
  • SHA256 2f4291d3c2ce2c81518278bae2e7d341c27fd7dec5c2b4a09fab02f70ea44321
  • MD5 d6daa396b4530f41f2205517efae617d
  • SHA1 3dad0d782dbbd9cd8e293d37291eb5b3b673b690
  • SHA512 47a8f3e34c477edbc8c9072f5fe0ebfc665debd5f3506f4cee9192d35bbcb2414cf526b2dc354b137e6e116b084779e97c573d0b49afc8183220012c0ad9603d
  • SSDEEP 24576:QJxvR1uPTHObSFII+wunJcwp+vYnmILlroAL2vU1kbXWoRyawcjRxc/TxROFpbBx:uF6PTHmSFIIH
  • TLSH
    T13C768FF822046DD6D16F4BB7E9E8B9E913760663DA8FA8CC41A427C305B3769FD14C09
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionevolutionratpersistenceprivilege_escalationratspyware

  • Family: EvolutionRAT

    EvolutionRAT is a Windows RAT written in C.

    ratevolutionrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    908Sena-MINTICREC.xhtml
  • Size 6.9MB
  • SHA256 044286a793d23b71ad65386406661ff92e2196d4e39cf7b707e358d73f1bfbcf
  • MD5 b2bcb712a694566ae0a149e343316468
  • SHA1 789116de2100fdbdd6ed407fb183165e83360086
  • SHA512 d13c98def6d6951087d1e24ae6685e114d7f614abf3307f8317ed21cda06b67cadef2b8649e9b8bb01920837b07b5230c0da47f39bf831393ca86e3325616868
  • SSDEEP 24576:qvR1uPTHObSFII+wunJcwp+vYnmILlroAL2vU1kbXWoRyawcjRxc/TxROFpbBv9b:M6PTHmSFIIHf
  • TLSH
    T13E768FF832046DD6516F4BA7E9E8B9E913760663DACFA8CC41A427C305B3769FE14C09
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4