Extracted

• • Target
    HSBC Swift Payment 300726.js
  • Size 83KB
  • SHA256 8c66f4c0b0b3c733363c1a4fa7c1f13a116ea1d7aa21f0809118625f62ed32cd
  • MD5 5f730ce9623dcc352a990ad17770e48b
  • SHA1 ce10c7c4874822b86ee75b17fef21cba97384294
  • SHA512 d219a67fce97e558bd019a896158d573619bbec0f6b7a476dae6df1f97a408949f4f45189ce4207a3024a38b089205c7766752755a4bbcc0b2dd04256f0d03f9
  • SSDEEP 768:iP0rbz1YuAw9t1AiTD9poB596H6wSftpE6atYE3NoL8:cu/9Lz9poB596H6wSftpE6atYE3NoL8
  • TLSH
    T15483C1FA22B65875EBDFB61174A6C265FCC982F32B09D848E1045DDC83AB640AC3F5D4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  group1a960186a4f0446948e640c091cf27a4dcollectiondefense_evasiondiscoveryexecutionlxbaseratpersistenceratupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2