Extracted

• • Target
    Declaration Aproval Details.pdf.vbe
  • Size 3KB
  • SHA256 206cfbabb6175852a80ccfff9884e6019a39d712de6c198a3ac43e4e4e9f9c45
  • MD5 69431a22b7b7f5c003ca2bcc0deb88c5
  • SHA1 51855591aad87ba6d66b9535fd1efa4f4c503254
  • SHA512 db4360f52f6515027f9dff0623679ce87b68efa40977136d1e3704eba9ffa185bec6441e425b382140e796bf0352cdc04b06b4fe1e6a6814c0433c36ba8bb86d
  • TLSH
    T1ED51424B3E02C53959B2CDA4CEBEF829E9D0346B65455C04F65CCD43DF3226AB1301E9
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  group126e0c7f5f459424a99c5778f99297a1dcollectiondiscoveryexecutionlxbaseratratspywarestealer

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2