Extracted

• • Target
    Quotation Request – Purchase Order-19-07-2026.js
  • Size 1.8MB
  • SHA256 76a5efb8c5ed5dae5516d4fd93a91f564b1b07d14f89fdadf5ec6f6e669636c3
  • MD5 21b4248f19d3bb296eeb034cb8847a7f
  • SHA1 c39a9b22cf501202d27c21cd327c6b7c9a17af38
  • SHA512 82a0e806f187b6e554f44125f37755327e0c067aa95463236df76cc394a99987c029580e364c610010b4af78d0c267bea18639d568a7334f8931286f61570fc7
  • SSDEEP 49152:JfyhKtajByf0MBeuiJZXgYldD5CKjSubtSAm/VPogccNEbwWKZh5IWbpW:JfyhKtajByf0MBeuiJZXgYldD5CKjSu/
  • TLSH
    T11D859D85D9355E5F9EF005B3B8CA5C919EE0E29C22E807F6F6C15C3A7B04D30849A6F6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  chi-monday7015cfe3757d443aacd30c58661eddc7collectionexecutionlxbaseratpersistenceratupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2