Extracted

Extracted

• • Target
    Consulta de compra.js
  • Size 1.3MB
  • SHA256 3c291f54d4be33cd4edd5b177dd9a527313dcc03124bd628cc8532b7e0eeebe3
  • MD5 924acb7151e4c31307ae3e4f0a8f2440
  • SHA1 438cb9ad379714358e5e64f041d4657e3d2b4999
  • SHA512 38b9343e96d7d64de39af9fb1859fc74cc13203ec84b047f427dfa0679afbfbf22f168f3db266e98a6426c34a9123390f120b35ab8874aa6557dcd41a95bfeef
  • SSDEEP 12288:RjHNFkvoTUmw5ryBHgk9xVyxDp4fYwBhHoVhIoHgVT+UF3nQVPYbEFShXKtGwpfb:Rvo8IqV1UpNbvNFTReipjFbKRWtN
  • TLSH
    T1AA559D43A0D2AD2F14289B6BDE3D01663AF1E798F440D481F79CD5ADBBCA93DC864670
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  group1a70cd51de0974798adfa21bf0f3891d5collectiondiscoveryexecutionlxbaseratvipkeyloggerkeyloggerpersistenceratstealerupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2