Extracted

• • Target
    _b96de257d26532ce1a6b799ace74e9038d3c4011c28d6f65fc67f5ee07214296.txt
  • Size 3.0MB
  • SHA256 b96de257d26532ce1a6b799ace74e9038d3c4011c28d6f65fc67f5ee07214296
  • MD5 7b592fe7dfd6f62cfe9d7180b1abc365
  • SHA1 91fced65dfc77a4910cc217dbd57d032e6e55f5d
  • SHA512 545e8a4f559f70e809ee95a1a36429f5875b4835c90018dcbfc46871f20f41f6c887c69ff275378a7112ba045757bc2aae1dca01d46de8800ac44a1cee71643b
  • SSDEEP 1536:Mt9e5A8GVE8qsIiZoSVuuAn0YQXmuCXfjOU2cEFNIdtnH49SMfSKuR58VrRbYHY7:m
  • TLSH
    T19CE5385303851BBDF69D0EC9C94B215B20F2D46B7D251298EBB36EE7BC3B9849430636
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  7 jul 202601fed6256afe478690e47698f3440ddbexecutionlxbaseratpersistenceratadwarespyware

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2