Extracted

• • Target
    ĐẶT HÀNG _GIÁ MỚI_..js
  • Size 773KB
  • SHA256 e2f9eeae126236bb235433322d5bccdfd605ec08607c8b367fb63da3aec7fa0d
  • MD5 165e37b1c96d9d3124f420ff6e64384c
  • SHA1 be16f8fa15119176f247c68121fd841a064058fb
  • SHA512 5cfd3017542c03fc524c4e385615854947b9732019f223e53caf58243eabbca84bc45181c10fed728d97e32241c282dc021230ee1a0dd576e97f81f45e23bb0b
  • SSDEEP 24576:TAIKdDeaHgUTLLYc6M0VZfCQdtmLyR19Z:8PdD3PWrdqm
  • TLSH
    T1C3F49F081391DE5A0C9A73EB076D05E13EFCD80C8B5286C0B989FB6B9FC4A25D69D1F5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  group11a83f37a318549ff9e552cad18eceb6dcollectiondiscoveryexecutionlxbaseratpersistenceratupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2