lxbaserat | 5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed

General

Target
5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed
Size 1.1MB
Sample260801-jmgdss1bre
SHA256 5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed
MD5 33684f618c42ada10f5bbd38059427dc
SHA1 7a60a9c1816d66f2c3cb3aa1366c95e6fbd3b158
SHA512 d893b4d1fec388f38d17fce354b239609452946c2b8b4ec1999a672706ddbc9b1c793dc75588726fa4f6179e7738b14f1be3fc27b7d53d85948b558ef3531f46
SSDEEP 24576:eGyxl/k7gGVBIB4G2CpytdXCcCxuS1uY35rWQ4toxX2pny1yaah:conBIB409cHI+eXayU
TLSH
T138452364542A51DB0D11D1FFF326B4A9318E33DB0E866326025AD2E630F89F55AA7CF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

lxbaserat

Version

1.1.0.0

Botnet

Group1

Campaign

f05d330804da4c22a1a4d4a1c24cf06d

C2

taivvan.ydns.eu:62050

Attributes

directory
Logs
executable
client.exe
password
XEbB32mOKJlFEWoYF7oa

Targets

- Target
  5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed
- Size 1.1MB
- SHA256 5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed
- MD5 33684f618c42ada10f5bbd38059427dc
- SHA1 7a60a9c1816d66f2c3cb3aa1366c95e6fbd3b158
- SHA512 d893b4d1fec388f38d17fce354b239609452946c2b8b4ec1999a672706ddbc9b1c793dc75588726fa4f6179e7738b14f1be3fc27b7d53d85948b558ef3531f46
- SSDEEP 24576:eGyxl/k7gGVBIB4G2CpytdXCcCxuS1uY35rWQ4toxX2pny1yaah:conBIB409cHI+eXayU
- TLSH
  T138452364542A51DB0D11D1FFF326B4A9318E33DB0E866326025AD2E630F89F55AA7CF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

group1 f05d330804da4c22a1a4d4a1c24cf06d execution lxbaserat rat
- Family: LxBaseRAT
  LxBaseRAT is a .NET remote access trojan with stealer capabilities.
  rat lxbaserat
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Family: LxBaseRAT

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2