202611041636_Devel Security - Evento de Seguridad ##RE-9638339## - Conexiones Maliciosas Salientes - High_Alta_edwin[.]ajucum[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
202611041636_Devel Security - Evento de Seguridad ##RE-9638339## - Conexiones Maliciosas Salientes - High_Alta_edwin.ajucum.zip
Size 16KB
Sample261104-2jrdpsdy7y
SHA256 9b3c9b788ae32f12e60bedf4779cbb318b4328f1e700ae5e85de8fd1b7e5b216
MD5 9e72e9b5a1e98b6317756fcad4818eac
SHA1 6c5d2d37bdf98145002f1dd18618120634e038fc
SHA512 da4da396db7becc23467becc974b676ccccbc1e75f87b54002017d8418d3c42e5d0d9f6af7123116e0a480750ec007fc9c7892a522366e7081575f9bf0ce3a2e
SSDEEP 384:/N7lOOtiMFNwdgDrZKO2zrBextcJ7FzsClLi1gM7KgPfcBmN9k:l7VIKNwgPZgBexW7FzJlL8gqKgP0s2
TLSH
T15A72D0DE506806497B794FE20D59804B1A7BCA39C40EA0EE5958E3F0DDFA3BFC915264
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

202611041636_Devel Security - Evento de Seguridad ##RE-9638339## - Conexiones Maliciosas Salientes - High_Alta_edwin.ajucum.zip

.zip 16KB
20261104221619-Devel Security - Evento de Seguridad ##RE-9638339## - Conexiones Maliciosas Salientes - High_Alta-edwin.ajucum.eml

.eml 42KB
email-html-2.txt

.html 17KB
email-plain-1.txt

6KB

202611041636_Devel Security - Evento de Seguridad ##RE-9638339## - Conexiones Maliciosas Salientes - High_Alta_edwin.ajucum.zip

SHA256 9b3c9b788ae32f12e60bedf4779cbb318b4328f1e700ae5e85de8fd1b7e5b216
MD5 9e72e9b5a1e98b6317756fcad4818eac
SHA1 6c5d2d37bdf98145002f1dd18618120634e038fc
SHA512 da4da396db7becc23467becc974b676ccccbc1e75f87b54002017d8418d3c42e5d0d9f6af7123116e0a480750ec007fc9c7892a522366e7081575f9bf0ce3a2e
SSDEEP 384:/N7lOOtiMFNwdgDrZKO2zrBextcJ7FzsClLi1gM7KgPfcBmN9k:l7VIKNwgPZgBexW7FzJlL8gqKgP0s2
TLSH
T15A72D0DE506806497B794FE20D59804B1A7BCA39C40EA0EE5958E3F0DDFA3BFC915264
MD5 SHA1 SHA512 SSDEEP TLSH

20261104221619-Devel Security - Evento de Seguridad ##RE-9638339## - Conexiones Maliciosas Salientes - High_Alta-edwin.ajucum.eml

SHA256 9adf409649fbb296d729afdb05b4f7ae844f7b221df5f70615d1b592b64a0299
MD5 08a5ab92bc10ec8cc93814d12ef62e4a
SHA1 26c354e02787a7688a9d4a19e07b7d19b16098a2
SHA512 1bbd24fc55a843d8dbec179516f7cc0e261412059979977fe077eb49a4d92181a7fac227927bfc06dba91c6725dd2c45649fb904f8e1f7e30b3705573a6e086a
SSDEEP 768:Ym6nlt0JadEDwyH5UFujDjMiBeACDEH7FEfF6RPaOSn18csh5aqbQ4yTRzUzv:Ym6P0JadEXE+j397FEfF6RP9IuBd24v
TLSH
T162137D32894334B6C9104E40A415BE676531BF4BA2F380C11CEEDED5497A96A1EF2DFE
MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

[email protected]

From

[email protected]

Date

Wed, 4 Nov 2026 22:16:06 +0000

Subject

CAS::Devel Security - Evento de Seguridad ##RE-9638339## - Conexiones Maliciosas Salientes - High/Alta

Content-Type

multipart/alternative; boundary="_000_010001a1a8a23884ec68ee68df9a4d97b486a8d6f283cdeb000000e_"

Received

from SJ2PR22MB4226.namprd22.prod.outlook.com (2603:10b6:a03:546::5) by DM3PPF2F3BE8063.namprd22.prod.outlook.com with HTTPS; Wed, 4 Nov 2026 22:16:18 +0000

from CH0PR03CA0046.namprd03.prod.outlook.com (2603:10b6:610:b3::21) by SJ2PR22MB4226.namprd22.prod.outlook.com (2603:10b6:a03:546::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.9; Wed, 4 Nov 2026 22:16:08 +0000

from CH1PEPF0000A348.namprd04.prod.outlook.com (2603:10b6:610:b3:cafe::80) by CH0PR03CA0046.outlook.office365.com (2603:10b6:610:b3::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.592.10 via Frontend Transport; Wed, 4 Nov 2026 22:16:07 +0000

from a48-33.smtp-out.amazonses.com (54.240.48.33) by CH1PEPF0000A348.mail.protection.outlook.com (10.167.244.4) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.592.5 via Frontend Transport; Wed, 4 Nov 2026 22:16:07 +0000

Received-Spf

Pass (protection.outlook.com: domain of mail.develsecurity.com designates 54.240.48.33 as permitted sender) receiver=protection.outlook.com; client-ip=54.240.48.33; helo=a48-33.smtp-out.amazonses.com; pr=C

Message-Id

<010001a1a8a23884-ec68ee68-df9a-4d97-b486-a8d6f283cdeb-000000@email.amazonses.com>

Extracted URLs

file https://attack.mitre.org/techniques/T1071
file https://biomimicrydevtech.buzz/index51.php.
file https://support.develsecurity.com/WorkOrder.do?woMode=viewWO&woID=9638339&PORTALID=1