Extracted

• • Target
    HSBC Swift Payment.js
  • Size 77KB
  • SHA256 49fe73f573adfe963be35d4e5058fb441729fb4970f68d3d900207eaee0b55a8
  • MD5 80f75e1631aa7af1c9ecc46f40cc6236
  • SHA1 b53aeb4a4bcbf3dfbcb6f1ad215a0a853289751e
  • SHA512 08b5e34b8fd2ed0c58c0b7ff661cfded9e66df5ead015473789d586db6491524ffdfd362211a812cb76a297991440c27c6634c43400e14c06eb428ff74bf487c
  • SSDEEP 1536:/qN4MMMvr24U8+X3YktX3mHci14t+6rkCX:/U4MMMvr24U8+X3YktX3mHci14t+6rkw
  • TLSH
    T19773AED9557ECE792FC98C0FC665580BDAC94A027F9F700375299CCDC2283E82AA7527
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  group1a960186a4f0446948e640c091cf27a4dcollectiondiscoveryexecutionlxbaseratratspywarestealerupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2