Otro Mail Malicioso Simulando TGR (METAMORFO)

# Nuevo correo malicioso simulando Tesorería. (AutoHotKey downloader --> METAMORFO)

From: Tesoreria General <[email protected]> ([13.78.132.130])
Message-Id: <[email protected]>
Date: Thu, 13 Aug 2020 19:49:30 +0000 (UTC)
(Correo se encuentra detrás del dominio l20.serviciosdesociales.com)

URL de acceso: http://www.rodap.com.br:3535/0D10H4T61/webmail/
Reenviador: http://www.tafoot.com/mails/web/2020/
Descarga final: http://www.tamariskrtw.com//pma/setup/acepta/0F56ASF12A.lit

Archivos descargados:
-----------------------
md5: 444eb64d0313189663946b19f06c46b4
sha256: 9cce6460bd24551c32ad544c4bd136fda11e579cf07b2566a1edc3d5c859015e

md5 a57a32078dcce69e78f1373908f72e4a
sha256 ec1d25821edc360759644b19f725471a7deabc4d1c437c6032037d82206d8cb7

md5: a7f81d90dfde2ef7adb5590f66887446
sha256: 38fd21ecc6f67861509a62492f5bd01af298fa299dc4c94021be3d9971bdc4f3

md5: 6e3d23a899363313ea40980baf5f5af0
sha256: 2a701bd429a93c19599dbd24d5d55d5af72fb03c23313e28dcf8e81b66dccae7

md5: 3d9e621aa8d9d1a97eff65affaee6cc2
sha256: 54e90ef3b2121408e03bb343b70583fe15a2ca24d5d76e8129766dbaa22817c5

md5: 830d938d575de3df6c7d3c0ee751ad9b
sha256: 0a9964fe0e0fb3f0679df317a65f9945c474dab8c4370b45b93da64a8b201b9f

Referencias:
https://www.virustotal.com/gui/file/38fd21ecc6f67861509a62492f5bd01af298fa299dc4c94021be3d9971bdc4f3/detection
https://www.virustotal.com/gui/file/54e90ef3b2121408e03bb343b70583fe15a2ca24d5d76e8129766dbaa22817c5/detection