Extracted

• • Target
    Purchase Order- EE2607-3163 -July-17-2026..js
  • Size 1.2MB
  • SHA256 2f7404419039fc2f57f8442e3de6eb24abebefdbd8aba5c61e41e8247fbb9a09
  • MD5 586fa60eaa603e5d0efc35e6f0f55eab
  • SHA1 fc434b7a95f626d50efccf2488f61adb27d687c8
  • SHA512 ed8e5141c66c4db800e1154b66d4852f248e4efd597ae3203a3c2fe3cc76c0558ee791838bd9ad980a2f84de5e997ca3c91734e236b72c117c28a5a6934cc62a
  • SSDEEP 24576:t/hGaOtXWpaFJ1X9zrT+ePs3noO3R87EiP/4DwUGt81rkKRiL2Dai7W1oNAfNFgc:x5OGQFXVrTzEXoOhyES/4DP1rkKRDaiK
  • TLSH
    T101458DCCC41D273D84107EEB1DEA30AB53DB29055F27759913987300F1AA1EE9AD6CAE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  july-17-202667d58c4fd2364ff6b926dd4713fbb545collectionexecutionlxbaseratpersistenceratupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2