Overview

overview

10

Static

static

3

New Order...26.exe

windows10-2004-x64

10

New Order...26.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    23072026_0618_New Order_22_7_2026.exe.tar
  • Size 2.3MB
  • Sample260723-g2ms1seq2y
  • SHA256 129099489a6dff50341b96d2b8bcae69c7fe1af5e098272717a168a18a856978
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
lxbaseratgroup19e3c034dcb674dcf8770e7f5358d8b63collectionexecutionpersistenceratupx

Malware Config

Extracted

Family

  • lxbaserat

Version

  • 1.0.21

Botnet

  • Group1

Campaign

  • 9e3c034dcb674dcf8770e7f5358d8b63

C2

  • 64.89.160.127:4561

Attributes
  • directory

    WindowsTelemetry\Logs

  • executable

    client.exe

  • password

    JYgDiRJcpUr5zyqs5HSF

Targets

    • Target
      New Order_22_7_2026.exe
    • Size 2.3MB
    • SHA256 8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    group19e3c034dcb674dcf8770e7f5358d8b63collectionexecutionlxbaseratpersistenceratupx

    • Family: LxBaseRAT

      LxBaseRAT is a .NET remote access trojan with stealer capabilities.

      ratlxbaserat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks