Beware: Self-Propagating Malware Spreads Via WhatsApp, Targets Brazilian Users  
Indicators of Compromise

SHA 256									Detection			File name
2150f38c436eabebd3a93b3ace1064315153c882ce763991b6d0fb798766e0db	Trojan.LNK.SORVEPOTEL.YAFJB 	ComprovanteSantander-18736748.908476642.lnk 
bd62148637152396b757c8b106d5a62982bce9df12f0a6030dda9138e44e7328	Trojan.LNK.SORVEPOTEL.YAFJB  	DOC-98083986_4B17B4B2.lnk 
2d83c4d620866f4ae647ed6a70113686bb7b80b1a7bbdcf544fd0ffec105c4a6 	Trojan.LNK.SORVEPOTEL.YAFJB 
3b68826e4a1d95b1dd58b3bf1095750f31a72d8bddd1dbb35e6547ac0cf4769b 	Trojan.LNK.SORVEPOTEL.YAFJB 
1a0af26749f5bc21732c53fc12f3a148215c8221cbeffe920411656f1ffe7500 	Trojan.LNK.SORVEPOTEL.YAFJB 
441a2ad553d166df3cd0ea02482f4b8370e8f9618753e1937a251a6318cb8eba 	Trojan.LNK.SORVEPOTEL.YAFJB 	ComprovanteSantander-63800793.391345519.lnk 
dcdde53c50aef9531c9f59f341a4e2d59796cdd94a973f2c2a464b2cafed41f5 	Trojan.LNK.SORVEPOTEL.YAFJB 
c50b6ff360e5614d91f80a5e2d616a9d0d1a9984751bf251f065426a63dac0b5 	Trojan.BAT.SORVEPOTEL.YAFJB 	HealthApp-0d97b7.bat 

IPs/URLs: 

expansiveuser[.]com 
https://sorvetenopote[.]com/api/itbi/Q77xivT4udoXayYELTwehMD666ovP6DZ 
imobiliariaricardoparanhos[.]com 
sorvetenopote[.]com 
www[.]expansiveuser[.]com 
www[.]sorvetenopote[.]com 
zapgrande[.]com 
sorvetenopoate[.]com 
sorvetenoopote[.]com 
etenopote[.]com 
expahnsiveuser[.]com 
sorv[.]etenopote[.]com 
sorvetenopotel[.]com 
casadecampoamazonas[.]com 
expansivebot[.]com