Extracted

• • Target
    RV_ 4100789459 JDO. 002 CIVIL DEL CIRCUITO DE EJECUCIÓN DE SENTENCIAS DE PITALITO -- AUDIENCIA DE JUZGAMIENTO -- PROCESO_ 41551051501220232468400.eml
  • Size 9.6MB
  • SHA256 c0a1dc40819ac21781515338aee422e891015a4dfce4bdb6af1897673ab38775
  • MD5 93d79da4880e05755b4ad1832e8ad7d9
  • SHA1 144a5e2298c22a30771a3f35306cff462d0d4022
  • SHA512 99a7a86eb26f62ebf1adbd3d7eb92b4e48c7a3184051f1283f85f9c4354decaab9f06ae14e59f82868726d4e2bc4d6a8ef5405c9254a1612c51eac15fb50c7ba
  • SSDEEP 49152:FzAyr+n+yzW4Hjp8xBicBIUoUgrqoq00Fkutx4qf4lcwv0czQWpc9tJB81znveUc:x
  • TLSH
    T155A62AF232EFBA4E5A04375DA44D29184F9ED4314983AAD890DB4BC4504F86F2AD4DBF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10

  adwarespyware
  behavioral1behavioral2
• • Target
    308420-417.335375-Tramite.xhtml
  • Size 6.9MB
  • SHA256 2c5025c58661e935cf71941c0f75d8dd16f2af45de707e3aca2dbe289ca28e92
  • MD5 be249e70be06abaad3ad960cf7b96ced
  • SHA1 25a5829fc3bd1237b6646c9d253dce4f658cb1a9
  • SHA512 3d5886bdb4b5e9fdab28220a5aecb7d3604d727697b57eed6c069254ea0eccaaca5ebdb6c698eccda095b990f21570af7fd22f7a389d0a6c496fe50a938ee64a
  • SSDEEP 24576:xvR1uPTHObSFII+wunJcCUysc3Z1zVl7hmZlcqKC8nN7Gy2SjDObsqzXc6WmoM/Q:F6PTHmSFIIHs
  • TLSH
    T1E976AE78B9087D97252E56AFEE9BB5D813742513C997D8CDC0ECA7C314E32B9ED02809
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionevolutionratpersistenceprivilege_escalationrat

  • Family: EvolutionRAT

    EvolutionRAT is a Windows RAT written in C.

    ratevolutionrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Deletes itself

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Probable phishing domain

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    email-html-2.txt
  • Size 13KB
  • SHA256 87c02da2228e490213ee047e9159b4005b30292a7e6ee1f054b278e9778eb696
  • MD5 f0c33f5a81cba3be5357eeb8cc0cc07b
  • SHA1 486e550ad74305afc9a5e64460dc290e59eec729
  • SHA512 22cc55c038503fcc06bc5915909cc8f1cb6410492b6e524b9ad59792db34b1c2f7690f996b2ad9c86f7f669b33401354b79380beee08e091568af0da649b9dc6
  • SSDEEP 96:ZHypHPB+j+IqTkZqzQQVtGYwZhYZhRZh4fZhYkMZhLyZh9KMMZhhSi/Agp6mqjEJ:ZA+j+IIqxUkJ76b/AgJIEM35Q
  • TLSH
    T19052D843F2D01E0950EB89E4A153B77DBF3C42C98B664F7874597BBE6AA8CD30211278
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    email-plain-1.txt
  • Size 2KB
  • SHA256 99131f0b9505a6c62e970e59c988c6a8f59cdbdc1a279a8c8c39f801afd13670
  • MD5 c43998b618f830b0b97c134d75bae31e
  • SHA1 1f780214c6751d6ef46e64f10b9ed97852ea059c
  • SHA512 900e8c08d440606a2a7542d8ace4e4bd54465f9691159a461c5038d7b873c86e5ef94d209dbf5f373958930c53d77efe9d11f223df903bb6b4f11cf3cafe125b
  • TLSH
    T16351A65A0EC5075E25C372BAF143C86FE0D085C5F66CD2A431F5862515CE6CDD20883E
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    image.png
  • Size 42KB
  • SHA256 ef211f9c48a0d2f65ccbf6e0d57befe7be249d944b9e2a803070f4efd6da3e7b
  • MD5 ba38ca551700ffc70c10e38aa096efa1
  • SHA1 63ac014ec89b9a62528d19e73b168d0c03c8cd7b
  • SHA512 c868a5b94199ba8de958c30967be06c30d0f5dc47d3e8c72b8b549d3067eec2f8243c26fd67123b5161beb54d808615aeafec6977e868748ad209890e079d1db
  • SSDEEP 768:CFq+JwFBQY3yp1aXlZOKD5lqBbtsaRy3GVxtVZ1CfyTT9WBeRu+mPz6FY9UdmwAq:B6IBQY3ynaXln9IQaRuGVxvbTT9gmmPy
  • TLSH
    T14413E17ADE53F2A9DD1F2134680A2E1A53843A0C977015F6CA7690EEC7642B770B380E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9