Extracted

• • Target
    Bill of Quantity - RFQ SUPPORTING DOCUMENT.js
  • Size 1.4MB
  • SHA256 8ba50aa5ff6d7653d79b9bdef6dd662bbae2ce3799a910d224be3384e72e9942
  • MD5 0c0cb60f0d0e3d1d81a4eef2c16f45f0
  • SHA1 f371da3a836b9a76da7fcf3738ced17e3175a3b7
  • SHA512 3dcad09339b65366fdda809fc400c105e4b4e97ec227bc381db5ff9934d9995e2f36a72972d1c0532689dcdf57050d5c1f81bb3c317753e0756a6ff83f611889
  • SSDEEP 12288:5bUcBgpYPhOUGf/nRbSICbEscX3x3/vQFARfOveT6RJSxfKRPZyTmwFTrYrPaT+t:hUeb2qxYR/vEc+JAtrgFsr6
  • TLSH
    T10765FC815611E17E5B97CE582F47AADC28A9D9EFD8C9E304F0D40A8FF4AC63894E47C1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral1behavioral2
• • Target
    Requirement List & Specifications.hta
  • Size 30KB
  • SHA256 5435ec2d38053a71a2f474407f4be84dde6b763f88d026c9d59b7f253b0a184e
  • MD5 6cae0521449ffea1c590b436d2e43be6
  • SHA1 baf19c4a3f98b102fbc67892f269133246aacdd0
  • SHA512 208e7d24c7d6d347aa9eb2cf4d982c727315f3a71ee1ed269cf2b8eca7f81840b11bdde7ce9555e8f7b12da6f33903b77ea93fc52291bac7de2715611ab7de78
  • SSDEEP 192:vTj45ewNSe/7zygoWWhlrC8VnfXuS/q1K91q1LPOUApxPpe3bc1rqCOVkyM5DJtJ:vShCVLRfXXqNrCV3NVLYsQ772ue
  • TLSH
    T195D2D8C7B2CD2F79C7BCC8DDA07A9C4409D4777A0CA68A309AF4844FBE9E52504786B5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  frost zynovaf97c184d3ebe4ee9ada1a3cd041ad9fecollectiondefense_evasiondiscoveryexecutionlxbaseratpersistenceratspywarestealer

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4