Extracted

• • Target
    Consulta de compra.js
  • Size 774KB
  • SHA256 dc114a3f6fa295dbae5b0b601a66e57505b74b70a773d71f9ea1fdc3b6673349
  • MD5 3769a0c9db4b24d9781dc234e1fb694e
  • SHA1 34687c8364a53ad706429df42c05522bc1cf4078
  • SHA512 4cdcd714278f164e02dc2df417e6bf026771f9e5fc91466767cf4362a957a3f97f0199f1cb63c887052c34f88bdea0c75509c7526b04533cf3d0c6489124d282
  • SSDEEP 24576:5K8VKp9OoQRUTS3CAhcNzPPQm46oiWUX2:5HqKnc54DIX2
  • TLSH
    T115F4AEF0F5F1A0A411D4CE389A7E63027494B07B1E2186A6B571AC4EF25CB53D9D28BF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  group10e88bdb59f4f4644a31d22e3c4d7da63collectiondiscoveryexecutionlxbaseratpersistenceratspywarestealerupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2