Extracted

Extracted

• • Target
    Inv.534635635.vbs
  • Size 1.1MB
  • SHA256 323b89209895cf53e34e0ed545fd8372f499d1c1a994c7972b5e7f09d17d60ae
  • MD5 d32395ddb0dcd8d3c2518a47ed8d251e
  • SHA1 b4900d3c9d2ccdb7cea7267e5e28820a6dc3aef1
  • SHA512 6384e5bb94f6ed82737680c32d0905d112a8cb5a3adf1e731ac83a0ef61f0269fa27b368f55caf2a9b0eb3aa64eacd2117348aac49e26fe765ade0dd236d9236
  • SSDEEP 24576:6V1vME6P19rSGEbnQEsSbE+V0s8wZWTb0h3SnGtuDkCj2vDyj0SvxI:6VK3rAvZdh3GGt9D5
  • TLSH
    T11435AFB694D6D0C279329C538BFEF165C50D93323942386522FC025DC63ADBA3E929BD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  group1853238fd1fad403894dfd7efd76af7dfcollectiondiscoveryexecutionlxbaseratvipkeyloggerkeyloggerpersistenceratstealerupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Family: VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2