Extracted

• • Target
    Purchase Order- BE2607-3463 -July-16-2026.js
  • Size 1.8MB
  • SHA256 18e848ff796023fdd1bda29e43efe6b2485dfe7c910a537463eef99c35a7cc27
  • MD5 564177d920a5b1bb9d79cc32b843160e
  • SHA1 7e24b0e7821128b580096fc30b419713961b0b6d
  • SHA512 6a8329f5484c989436ea3185ede8efd353fe9cad5fbf40aba5b774abd0b92b74acc3c2559b96c4192a7b3978a97341da8d4928c4fedadec37d01b7c7217900a4
  • SSDEEP 49152:LjFoNCLlOcDkOC+JNT6LlSluRdbCebeI1:LjFoNCLlOcDkOC+JNT6LlSluRdbCebee
  • TLSH
    T113856B13A7C7538BB2393CBDF1D06E0678DEAC130539E8DA8FD68982595A984D07D34E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  july-16-202600f6a8a1db0d491984e8eca8a2881b30collectionexecutionlxbaseratpersistenceratupx

  • Family: LxBaseRAT

    LxBaseRAT is a .NET remote access trojan with stealer capabilities.

    ratlxbaserat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2