Extracted

• • Target
    Copy of 15 JULY 2026 AMENDED OUTSTANDING ITEMS FOR QUOTE.vhdx
  • Size 14.0MB
  • SHA256 84c683089efbcfaabb7f81612186ad3ef00a00effec769f92b4a3c04ac1389a5
  • MD5 dc22215841aca38909e193ba7c96f01c
  • SHA1 816d7f0096c5804fe2cd9afee0ed5a9c594d8149
  • SHA512 82e6634f2612bb9a56bbc1e5c7557c8c3d99f83147f5e4cb68364db172a12b4314f5ff4b3deef798d15bc33ccf32ed719a113c4109cc90d10a3fe46d742edb4d
  • SSDEEP 49152:Tb/Bzbr/+bvefIv4LqbefMKqFV8bE0N9LhL:RSepGiEjFEVV
  • TLSH
    T1F0E69E809A128717D1DC8BBB04BF1AA73333AED8ECC34D27993630A25E7E7815C9655D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  july-15-202660702bd6972a44caae9b9693eb68f81fcollectiondefense_evasionexecutionlxbaseratpersistenceratupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2