Extracted

Extracted

• • Target
    PESANAN BARU.js
  • Size 1.3MB
  • SHA256 0d1f96a91f041b01b95cbd79234cdf6359f3d831ecd90c135e8c2a3c2b8ead58
  • MD5 5507f9fd5cd04eb0ecf8103ca42a7a50
  • SHA1 c8f99c667ee385e3d0d3e88affffb67b1f078964
  • SHA512 98086dfcc9ec0bba4a93c1651e5d2341a8b80369604e27758f8a21a01b0f48a042b58d6d0dfc8867acecd2cbeac5b258f318b48f8e38a0464990af56c2c1bde1
  • SSDEEP 24576:RV7+6rQOvG4WjESC0JMLb8rAD00cROmFddpwrZ4WyFq+BGOURChZj7kFnVIr3zBA:bdewSybsAGnf58k1r3zHa
  • TLSH
    T1D3557DF0709475C899FF9F44D0ECBBAE43B2366518023D0BA58621B61F62FAEE14257D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  group1c7c2ba12f49340c3a0557870e4c40884collectiondiscoveryexecutionlxbaseratvipkeyloggerkeyloggerpersistenceratstealerupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2