General

  • Target

    https://www.albuspsikoloji.com.tr/2025%20inquiry.js

  • Sample

    250204-klpt8asrfj

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://res.cloudinary.com/daxwua63y/image/upload/v1738334533/alcb4htolzvfhzzufqh5.jpg

exe.dropper

https://res.cloudinary.com/daxwua63y/image/upload/v1738334533/alcb4htolzvfhzzufqh5.jpg

Targets

    • Target

      https://www.albuspsikoloji.com.tr/2025%20inquiry.js

    • Detects Obj3ctivity Stage1

      Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    • Obj3ctivity family

    • Obj3ctivity, PXRECVOWEIWOEI

      Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Accesses Microsoft Outlook profiles

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks