General
- Target https://gofile.io/d/rSnEzp
- Sample260712-tdj4faew7w
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gofile.io/d/rSnEzp
Resource
win11-20260513-en
20 signatures
150 seconds
Malware Config
Extracted
Family
-
lxbaserat
Version
-
1.0.19
Botnet
-
Group1
Campaign
-
c5b531c4879047ff9d66928e8db6ca07
C2
-
31.56.209.53:4521
Attributes
-
directory
WindowsTelemetry\Logs
-
executable
client.exe
-
password
rZFsaXW4aO5aINfGsuIZ
Targets
-
- Target https://gofile.io/d/rSnEzp
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of SetThreadContext