Extracted

• • Target

    paste.js

  • Size

    3KB

  • MD5

    affbcba0899f7fb6af87418706eabb0c

  • SHA1

    46e4e6b23c523a45a65dbd916f98f5476a4cd09a

  • SHA256

    6c15201ff41059d46bce1d287fd60ca954e9a1ae76e22dc475f953e4328acde8

  • SHA512

    68acae9c905e545f6d1fcec0255a4d13b9f0c8ddafb597b0ea2a686a6349d089a6736e6355cad19086ca66ad4c12e5ab732dc20990230636e3b5dbab374bc6f0

  Score

  10^/10

  executionobj3ctivitycollectiondiscoverypersistenceprivilege_escalationstealer

  • Detects Obj3ctivity Stage1

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealer

  • Obj3ctivity family

    obj3ctivity

  • Obj3ctivity, PXRECVOWEIWOEI

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    stealerobj3ctivity

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2