Extracted

• • Target
    RV_ REF. 94001443510220203280491 – AUDIENCIA PREPARATORIA _ _ DEPENDENCIA_ JUZ. 3° CIVIL CTO. DE INÍRIDA.msg
  • Size 9.6MB
  • SHA256 c419c40c123064a086bb82e460d00386b77a936e580b014e7422bb4623020cb5
  • MD5 ac46f2db65f68ff7476a65afe23ddf40
  • SHA1 6f7a485df71f2230f666762243ebb1e78ceac09e
  • SHA512 aed0698a5c5255f8260bc64936da750bc047b41e2bc349b3f7844460f4a03fe19461c070b6a92dca88edc70be86470b40f155fa86989b7e871a434100393bc50
  • SSDEEP 49152:KzW2gd9Pmd3RDp0c870V+YWES8jzumNE5A4vEgb9PGaWBSN7J4S4M3l69/vymBEf:n
  • TLSH
    T1DFA649F333DF764A5A05376DA80C29580F6ED4251A83A6D894DB0BD8140F89B76D0EBF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10

  adwarespyware
  behavioral1behavioral2
• • Target
    33187_Anulacion-Copy_dd14f7.xhtml
  • Size 6.9MB
  • SHA256 f4da8e0b4c088ad15762a5b5db20fb21787c9a0f01e26df0efcce3b7c5ce30ee
  • MD5 6e6abd2db59e94fe6fd02b3a9f8ed3d2
  • SHA1 07b20c87af9b1ad005b45ddacac55714f29f8d0b
  • SHA512 f7d921494cfaace201d6001dad601a744c2814e802b2af9e316738da357c7f45fbb6d3957a769817a828aac220775ae5f38e5c7784ebeceef0fb4484063eddaf
  • SSDEEP 24576:J3RvR1uPTHObSFII+wunJcpmNbmtb1akQhMLhST8FhYjsy0dsYTankZv2L8uVDaN:b6PTHmSFIIHp
  • TLSH
    T19776BFBC26082DD6167D5A6BDAE5FDDD03951223DE8F94C980B56BC305B372AFE02C09
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionevolutionratpersistenceprivilege_escalationrat

  • Family: EvolutionRAT

    EvolutionRAT is a Windows RAT written in C.

    ratevolutionrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Deletes itself

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral3behavioral4
• • Target
    Outlook-Banner cie.jpg
  • Size 42KB
  • SHA256 ef211f9c48a0d2f65ccbf6e0d57befe7be249d944b9e2a803070f4efd6da3e7b
  • MD5 ba38ca551700ffc70c10e38aa096efa1
  • SHA1 63ac014ec89b9a62528d19e73b168d0c03c8cd7b
  • SHA512 c868a5b94199ba8de958c30967be06c30d0f5dc47d3e8c72b8b549d3067eec2f8243c26fd67123b5161beb54d808615aeafec6977e868748ad209890e079d1db
  • SSDEEP 768:CFq+JwFBQY3yp1aXlZOKD5lqBbtsaRy3GVxtVZ1CfyTT9WBeRu+mPz6FY9UdmwAq:B6IBQY3ynaXln9IQaRuGVxvbTT9gmmPy
  • TLSH
    T14413E17ADE53F2A9DD1F2134680A2E1A53843A0C977015F6CA7690EEC7642B770B380E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    email-html-2.txt
  • Size 12KB
  • SHA256 0f52316a73caa26a2aab364bbaa3fb89f156f1e4ec02d0a1cfc51a47b0a801ad
  • MD5 f288519738fdbe17bd91cc4dc61cccdc
  • SHA1 2dbb39bf8d64a428b266739d68ee42a742662de2
  • SHA512 029068b89915f7bc0792501de065c3339632515a54d2d80af7c1f339dc712c8b9fb571038cbd86cba76c31cf0c576e79c3575088f7dec5cda1e7e6ecbed87fb8
  • SSDEEP 96:Z7r9glkjSkyOkRPLgfXQOqCzGylMlvzGyl1YJJOC/uWRAgE0HOsUXtxOYa++++rB:Zvjk2BRGlRGxAgEfdXtYaq
  • TLSH
    T1DB425146F3410D0B92E344FAF103B78AB2C24A84A14F847666F56767EC9EE34739279C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    email-plain-1.txt
  • Size 3KB
  • SHA256 76a33eedf7f75ebf3167385e6b23046132d74599943f4ac629578a46774115e9
  • MD5 7f37f48f7e2194d74c0a8d0788250d4a
  • SHA1 237c5cf76c1e69faf0dadc5ff881ee7291edb91f
  • SHA512 6ae6fc4d77e9e287c86cc6e7df71df28a63bda4f05532ac5cc6bdfbf87ec578b2d0181be64046c115e174cdbe43695bca30ee010a3b583e484d43ac89136e7b0
  • TLSH
    T1C681092C1BC7076A25D235EAF003D70FE0C091CAF4EDD1A0B2B98B1A394C91C422A59C
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral10behavioral9