Extracted

• • Target
    ΑΠΟΔΕΙΞΗ ΠΑΡΑΔΟΣΗΣ_w.js
  • Size 1.2MB
  • SHA256 60cd45011ec94f6d01c21271090d85956068dd10c9d5ab427117be73bfc44216
  • MD5 887296300fb4453c13f352e8d85a2b86
  • SHA1 c4e8a12bfa6b681e3494bab7cdcdb0e28ac95621
  • SHA512 96dad12afd614fd5e0000706d450424074f31ba27e78ecd327cc14aaf090cd56b2fdfe51de33da23d3f8bd32ba3fc46c7163920ee473ff216b4e673bf4db1b55
  • SSDEEP 1536:SQHNQNFXp0yZluhDKPd3o5tl3RBbIas0Nxxa7FcrsGuZDEntSHDTRKqwQTGQsMMI:SQHNy0XKP9onBEig14DbCG84VDtLri
  • TLSH
    T1B3455B5203851BBDF69D0EC5C95B245B20F2E8677D241258EFB36EE7BC3B984943063A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  group1648ddaaceaa84770a5d4ab6338c26934discoveryexecutionlxbaseratpersistenceratcollectionspywarestealer

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2