Extracted

• • Target
    RV_ N° Radicado 68081314504120256760976 _ Audiencia De Control De Legalidad _ Despacho Judicial_ Juzgado Penal Cto. Especializado 05 De Barrancabermeja.msg
  • Size 9.8MB
  • SHA256 321a0e46ddc7c8031561049a6efeccf1798f6c4e097a48385eadb7754bb61b8c
  • MD5 7f98b4c620cb910b24b2459c82d4b023
  • SHA1 8ae1f896d5b03919b9119e38ab5eb855995f2706
  • SHA512 5b3652105d172d470ca092665886696d1926bf882c30b0ca2af3231f6396787ea601573d590cf80add5c0353b55e9ea96717545f17912ca61127062bc8e0b91c
  • SSDEEP 49152:vzDSdeMRlwNRfK8cflr3KCoaNj3LJyEMaJxupea0Odfvt+Cg1OCMX9Wp59CXnbfK:y
  • TLSH
    T1E6A63BB332DE3607A90437ADA84D3A580F5ED4254E83B7D894CB4BD8105F4AB26D4DAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10

  adwarespyware
  behavioral1behavioral2
• • Target
    4385815 7801146 VER 1288945.xhtml
  • Size 7.1MB
  • SHA256 8112037e102ec6bacd2ba4ac04fde58fc0287baad47fa36850713604aabf2103
  • MD5 a81ccd49b8bc564022b4768ea1a6acff
  • SHA1 6f2158a75f61283c2419aa05abe8f15e5fde1397
  • SHA512 59a9a61d84ed8477ca20cf9a56a1e6037aff984a167bb4c4c64c0cc135323ec9f65d60dec338befe43e3931738e04a4a06e083b98d83d7090db36617132f5102
  • SSDEEP 24576:5vR1uPTHObSFII+wunJc6OsRiRT2+C7a0ue88HMYy24DJjVmrhekWn5aQbPqU+lQ:t6PTHmSFIIHr
  • TLSH
    T140769FFAA6043DD6796F521ED96B79DC43F15F239691E4C9C0A8BAC304633A3ED13806
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondarksideratevolutionratpersistenceprivilege_escalationrattrojan

  • Detects DarkSideRAT

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat

  • Family: EvolutionRAT

    EvolutionRAT is a Windows RAT written in C.

    ratevolutionrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Deletes itself

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Probable phishing domain

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    email-html-2.txt
  • Size 7KB
  • SHA256 37edb89714156240f8e804fb31728b6dbb84f62a2d79bf00f57d8122b76e837f
  • MD5 da2aa98886437144d88adf7999a05ade
  • SHA1 04aac8a390169d378b60464a9dec4cb38789a85b
  • SHA512 cac9c2d748f7089da260ff100d81665b63e8816829d480b1221a429dbe4d56758f669856089d8664a42e5ac4f1803c54b828cbe676fe412e8b74b2bcb8998d61
  • SSDEEP 96:Z7r9glkjSkyOkVPLgfXQOqCzGylDkOzGylixJJO0BwIrSY/Ag7roV:Zvjk6BRGsRGaIGY/AgIV
  • TLSH
    T1A2F16343E3941E0F96F348FDF113F78AA6835688654B897262B162A7D8CDD3422923DC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    email-plain-1.txt
  • Size 2KB
  • SHA256 bdcc86a0129c3b09385e6b7ae754ca3937a83c1688bd0a4037e0e70a6c9d5944
  • MD5 5248ab3b1e27ac8c3dcd9ab0c31f5438
  • SHA1 f99d337a673155fd65c9f93bdc6818aaa6ca6d78
  • SHA512 ae84b122a057682dd43980c8a58edb95c1b7f5eb95dc5c8e5f6d2d7d100bf544b1a98f159274690a2468a468edb41cf95885c41d2e2a0bc7c2c1b453cb583019
  • TLSH
    T1F051E68407C61F6E65A734BAF007A74EE4828696FCACC158F1B88A1B058845D61692ED
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    image.png
  • Size 42KB
  • SHA256 ef211f9c48a0d2f65ccbf6e0d57befe7be249d944b9e2a803070f4efd6da3e7b
  • MD5 ba38ca551700ffc70c10e38aa096efa1
  • SHA1 63ac014ec89b9a62528d19e73b168d0c03c8cd7b
  • SHA512 c868a5b94199ba8de958c30967be06c30d0f5dc47d3e8c72b8b549d3067eec2f8243c26fd67123b5161beb54d808615aeafec6977e868748ad209890e079d1db
  • SSDEEP 768:CFq+JwFBQY3yp1aXlZOKD5lqBbtsaRy3GVxtVZ1CfyTT9WBeRu+mPz6FY9UdmwAq:B6IBQY3ynaXln9IQaRuGVxvbTT9gmmPy
  • TLSH
    T14413E17ADE53F2A9DD1F2134680A2E1A53843A0C977015F6CA7690EEC7642B770B380E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9