Extracted

• • Target
    RV_ Audiencia De Control De Legalidad - Oficina_ Juzgado Séptimo (Laboral Del Circuito) – - Ref. Proceso 50001738319920264593100.msg
  • Size 9.6MB
  • SHA256 b51270fefe5a60aff177e69cbdb24fe10142f65f683664e3a1f55d227c802031
  • MD5 6918c3fa24f8c6cfa387bf1aa57038dd
  • SHA1 82a1d2565daff46fd35995b40d458744cdf6f98c
  • SHA512 62f22bf892f62252c823fed0162f9faa613ce1eaae658a46fee0099eacfd4dc37e1559107e2982c96795186fe164df13dcf27a8ba42c9d7421049c48ddb9f508
  • SSDEEP 49152:tzv2KYuyiFGdDVBMGSL9ibBMdeBtvemn0aAEfXaQXdBgCAUBuGjTjeC9IQRD80xc:H
  • TLSH
    T109A64BB323EF6A8E5905376CA44D2A5C0F5FD0615EC3A7D880DB0AD4104F85F6AD4ABE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10

  adwarespyware
  behavioral1behavioral2
• • Target
    desarchivo-2473539_Edicto.xhtml
  • Size 6.9MB
  • SHA256 37b14c3ec6e804a213fd42ea71a3426c907f3cdf8af590cc3c8a24e2eb44f2a8
  • MD5 46874c38e186f0ff6124bca5d9ecd8ca
  • SHA1 2c29bcb96ac3bbcfadac6508fa1516491e29f644
  • SHA512 6ace862d8c88f6c3dd6856be875c071624cf83957842bf4ac221f3108efc6c587466be757711d0e3a0a478f9e5316a9f9785296c358b4c57be5c619cba2df484
  • SSDEEP 24576:CvR1uPTHObSFII+wunJcNXMOGWyVX9PtEeNUdOyZmbm/P1x4XJjAshbsS7Rjpwzo:E6PTHmSFIIH2
  • TLSH
    T1E976AEF5B504BDE5A76F532BD5A96E8903741733898EE9CC407877C30A63362FE0A849
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionevolutionratpersistenceprivilege_escalationrat

  • Family: EvolutionRAT

    EvolutionRAT is a Windows RAT written in C.

    ratevolutionrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Deletes itself

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    email-html-2.txt
  • Size 14KB
  • SHA256 9438609dc13afee60f90e6dedb7ede12f7f41e906c7e75b8dad6bba5eca51412
  • MD5 2af2ddda56d4e7f4432ee855b919f22a
  • SHA1 3721eb758300ba0ea0aae36d884b2321cf50120a
  • SHA512 6e103803744f293b41e5bd64a30448be2216fba87c1d1579bfbe47337a0a9ae4110fc62e5e7231ba63c79f1c8d114c0c0297eda69ca5d4c55a8e76727802ec77
  • SSDEEP 96:ZJDuVn1rJFtJQ5/X9qlo8qixqcQo8/wZhYZhRZh4fZhYkMZhLyZh9OLDMMZhhSi8:Z8FUyosHN8kJAI6b/Agzv5KCmP
  • TLSH
    T19E52D743F2D01D0954EB45E4A143B7BC7F3852C48B664FB874997BBE6AA8CE30252678
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    email-plain-1.txt
  • Size 2KB
  • SHA256 45e0353b2d31e8331d40295e9783210db2287c4568d03dd4dbf5e788d21d0f5b
  • MD5 add02b6ca9dd03ace3e9247275fe704f
  • SHA1 7cc9a870b5fda63bb70722ed90c5f1636ee95b28
  • SHA512 3468c961ea95db02237933cf521b9e9ec3e62fee57a687dd7d36345a978f5e2bcf3b2732332eb1154ab40f670c3684312f88ca17e5b811093b40155792eea3eb
  • TLSH
    T1A641B7A41AD607AF26E730B9F203D94ED4447584F99CD1D870BE861B28CD65DE0079BD
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral7behavioral8