Overview

overview

10

Static

static

1

Przesłani...47.bat

windows10-2004-x64

10

Przesłani...47.bat

windows11-ltsc_2024-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    03082026_1552_03082026_Przesłanie zamówienia – PO-2026-147.rar
  • Size 997KB
  • Sample260803-tbe2psbg53
  • SHA256 25c7ad696beb5e141ced24081edb337538aa7c79115ed870254e02d11c7c8e6e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
lxbaseratgroup1590ef779505a4625abeaaf62ff99e58dcollectiondiscoveryexecutionratupx

Malware Config

Extracted

Family

  • lxbaserat

Version

  • 1.0.23

Botnet

  • Group1

Campaign

  • 590ef779505a4625abeaaf62ff99e58d

C2

  • skyredtest.noip.at:49792

Attributes
  • directory

    WindowsTelemetry\Logs

  • executable

    client.exe

  • password

    IOTpb1zIAxmcZaRbspjP

Targets

    • Target
      Przesłanie zamówienia – PO-2026-147.bat
    • Size 2.7MB
    • SHA256 76e096fbb24f6d94c6e37a657c98ca8fdc3b65933d07216d85d085332a067032
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    group1590ef779505a4625abeaaf62ff99e58dcollectiondiscoveryexecutionlxbaseratratupx

    • Family: LxBaseRAT

      LxBaseRAT is a .NET remote access trojan with stealer capabilities.

      ratlxbaserat

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks