Extracted

Extracted

• • Target
    8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9.exe
  • Size 2.3MB
  • SHA256 8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9
  • MD5 488e7b9bbb2b6de4dec92bd97824749f
  • SHA1 d678724fb4fb5b3b66650b394c4ed6619987ce18
  • SHA512 4f6550f6ad4ecfd82847742aa674c1c73c42553b791cc8cc8ed9f5d8622fd6ab613aa7d4c6788de01026b67efd3ed0271c52073f1575e5401925121302cb3a7a
  • SSDEEP 49152:anfHZ6Mj1gw8ul68qoRN66KUdZnEJh/Suy:anS6hdZq5
  • TLSH
    T124B5E820BFFA5874F1BF6E21CEE7B981D7EB7F725916854B2112170B09B18098F42A35
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  group19e3c034dcb674dcf8770e7f5358d8b63collectiondiscoveryexecutionlxbaseratvipkeyloggerkeyloggerpersistenceprivilege_escalationratstealerupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2