Extracted

• • Target
    Quotation 1380567 PROJECT DOOU.js
  • Size 773KB
  • SHA256 a86ef7bae584abfc22910223a63831976b95340470ae72b85604488faa063530
  • MD5 93525777501e6f6aa9a760fb98de7330
  • SHA1 46d6261a68b7199b19341fca5cf9b91d6d396c4e
  • SHA512 1b1e344f20be288ffdd9286fba0eb8254ed5fc0f72a4bbcf413357a1b434ce0d5f92b46f0e626d7eb1f33ba807fe3aea383d320cbeb672fc47c8d17050ac1080
  • SSDEEP 24576:5qYWrGFPXYWxv3H7KIIVWVHAyg1zR1Bmz:55AWJrKIWbRS
  • TLSH
    T1B8F423C1AB193FDF097CEA7A2501378B23C64F8689B882D8F7E05C1B439589E5B36547
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  group11890e289a8e24876b03f7195f1d5a1e5collectiondiscoveryexecutionlxbaseratpersistencerat

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2