Extracted

• • Target
    15072026_1057_Copy of 15 JULY 2026 AMENDED OUTSTANDING ITEMS FOR QUOTE.js
  • Size 1.8MB
  • SHA256 652d12352b1e6da3388c707ff9d700205ab2130126279eede4baa6a9d7cf5db1
  • MD5 061250ef31fedd73b9b0f034b9fb4e9d
  • SHA1 92e73a8ede1db304e2b07bb6a3227fde6ee2a538
  • SHA512 0d8afcff4bd8e9473df4173e1ba21a97792c93ca91aa26bc564dba0bbbad4cb2da5b152bf54cba7be8c195073ec695c83d4db0c0d16125e49b8094fa61c5ad08
  • SSDEEP 49152:vzbr/+bvefIv4LqbefMKqFV8bE0N9LhLc:HSepGiEjFEVVc
  • TLSH
    T163959E804D13876B15D88FDB04BF1EA73333A6DCECC25C36997730A35A5E6829CA659C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  july-15-202660702bd6972a44caae9b9693eb68f81fcollectiondefense_evasionexecutionlxbaseratpersistenceratupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2