Extracted

• • Target
    RFQ-SW10-321313_Ea.js
  • Size 988KB
  • SHA256 a1998deb197f8e5057893ecce3a983dcb46d8bc5b597a29ddde9182f24d0d801
  • MD5 862b3994ddbc3c6d8693e71eb46fd764
  • SHA1 ea35958e2c0c18cfc8c3a9c64a2e7d26b8442694
  • SHA512 9f2063f7334057dd0fb4bc593006eaa0e7361d64bd87e388131e656b024bd113ed02a5c0cc421f3af39b23e81800ef177b1fd9deaedbb2c0b6f0572282a7bbde
  • SSDEEP 24576:P7TfM4ziOt1xbSAu4oMvwqZcoSHszbUlPbt/Dv0cBCTICIz:PUHOZS64J//Dv0G
  • TLSH
    T1B92523029B59797953FF273842FF3B8B25C90DC40438B5DD8AA6A9D009C5B0F35AE66C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  Executiongroup1751ae7e9c8c941fb979aa3c76e45de43collectiondiscoveryexecutionlxbaseratpersistencerat

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL

  • Temporarily bypasses Powershell execution policy

    Using Set-ExecutionPolicy to permit execution of unsigned or restricted scripts in that process.

    Execution

  • Accesses Microsoft Outlook profiles

    collection

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2