MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bc6eaae334998da9df26e23803d97c537578cd02fa55370c98d418dec186ccc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LxBaseRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1bc6eaae334998da9df26e23803d97c537578cd02fa55370c98d418dec186ccc
SHA3-384 hash: 4f2d47b267876759319f8cd873490bd7fd1e048f093ae34147d05eaef070e610911852cb0e50b4a5b41919b850e7382b
SHA1 hash: efba35b1bf8d7857dbb06cd2fd838fb152b1c298
MD5 hash: 49c930aa9fc579976e4a36ff2a0b2417
humanhash: october-sodium-muppet-tennis
File name:Company profle_Project_PYLD_EF38B843.js
Download: download sample
Signature LxBaseRAT
Create hunting rule
File size:1'892'103 bytes
First seen:2026-08-11 14:31:09 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 24576:JHrQlaAb2MlrY7e6aNIMmCso8RHccBjJ4+O+:7
TLSH T1E195C9ADD8335F653996F30ECE46D8E509F36B030E53A1CE949E95AB0422734AEF3461
Magika javascript
Reporter abuse_ch
Tags:js LxBaseRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
attrib attrib cmd encrypted evasive lolbin obfuscated powershell powershell repaired
Link:
https://www.filescan.io/uploads/6a7b324bb54e1c7afc21880d/reports/9b037dae-baf2-4e2a-b5da-d916b0a01058/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/1bc6eaae334998da9df26e23803d97c537578cd02fa55370c98d418dec186ccc
Verdict:
Malicious
File Type:
js
First seen:
2026-08-11T08:59:00Z UTC
Last seen:
2026-08-12T13:00:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/1bc6eaae334998da9df26e23803d97c537578cd02fa55370c98d418dec186ccc/results?tab=lookup
Result
Threat name:
Clipboard Hijacker, LxBase RAT
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1956074
Signature
.NET source code references suspicious native API functions
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found stalling execution ending in API Sleep call
Found suspicious powershell code related to unpacking or dynamic code loading
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Sample uses string decryption to hide its real strings
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Unusual module load detection (module proxying)
Uses attrib.exe to hide files
Uses cmd line tools excessively to alter registry or file data
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Clipboard Hijacker
Yara detected LxBase RAT
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1956074 Sample: Company profle_Project_PYLD... Startdate: 11/08/2026 Architecture: WINDOWS Score: 100 80 Found malware configuration 2->80 82 Malicious sample detected (through community Yara rule) 2->82 84 Antivirus detection for URL or domain 2->84 86 8 other signatures 2->86 10 wscript.exe 1 2 2->10         started        14 cmd.exe 2 2->14         started        process3 file4 66 C:\Users\user\AppData\Local\...\Music.UI.cmd, DOS 10->66 dropped 98 JScript performs obfuscated calls to suspicious functions 10->98 100 Wscript starts Powershell (via cmd or directly) 10->100 102 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->102 106 2 other signatures 10->106 16 cmd.exe 1 10->16         started        104 Uses cmd line tools excessively to alter registry or file data 14->104 19 powershell.exe 14->19         started        21 powershell.exe 13 14->21         started        23 conhost.exe 14->23         started        25 2 other processes 14->25 signatures5 process6 signatures7 68 Wscript starts Powershell (via cmd or directly) 16->68 70 Uses attrib.exe to hide files 16->70 27 powershell.exe 16 16->27         started        30 conhost.exe 16->30         started        72 Hijacks the control flow in another process 19->72 74 Writes to foreign memory regions 19->74 76 Creates a thread in another existing process (thread injection) 19->76 78 Injects a PE file into a foreign processes 19->78 32 prevhost.exe 19->32         started        34 sihost.exe 19->34         started        36 taskhostw.exe 19->36         started        38 2 other processes 19->38 process8 signatures9 108 Found many strings related to Crypto-Wallets (likely being stolen) 27->108 110 Found suspicious powershell code related to unpacking or dynamic code loading 27->110 40 cmd.exe 4 27->40         started        process10 file11 62 C:\Users\user\...\net_profile_FKRZPIZN.cmd, DOS 40->62 dropped 64 C:\Users\user\AppData\...\net_profile.cfg, DOS 40->64 dropped 94 Wscript starts Powershell (via cmd or directly) 40->94 96 Uses cmd line tools excessively to alter registry or file data 40->96 44 powershell.exe 35 40->44         started        47 conhost.exe 40->47         started        49 attrib.exe 1 40->49         started        51 3 other processes 40->51 signatures12 process13 signatures14 112 Hijacks the control flow in another process 44->112 114 Writes to foreign memory regions 44->114 116 Creates a thread in another existing process (thread injection) 44->116 118 2 other signatures 44->118 53 prevhost.exe 1 44->53         started        56 sihost.exe 1 44->56         started        58 taskhostw.exe 1 44->58         started        60 2 other processes 44->60 process15 signatures16 88 Found many strings related to Crypto-Wallets (likely being stolen) 53->88 90 Found stalling execution ending in API Sleep call 53->90 92 Unusual module load detection (module proxying) 53->92
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/1bc6eaae334998da9df26e23803d97c537578cd02fa55370c98d418dec186ccc
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1bc6eaae334998da9df26e23803d97c537578cd02fa55370c98d418dec186ccc/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-11 14:32:32 UTC
File Type:
Text (JavaScript)
AV detection:
11 of 38 (28.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dpdovlrtjgmnvhpsnyryapmxyu3vpdgqf6svg4gjrvay33ayntga._file
Result
Malware family:
lxbaserat
Create hunting rule
Score:
  10/10
Tags:
family:lxbaserat botnet:group1 campaign:a4bc24d41e774ed6bf578cf73df3ba81 collection defense_evasion discovery execution rat upx
Link:
https://tria.ge/reports/260811-rv76gsvdrh/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
outlook_office_path
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Executes a command shell one-liner
UPX packed file
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Family: LxBaseRAT
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
vicblessings.noip.at:4500
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1bc6eaae334998da9df26e23803d97c537578cd02fa55370c98d418dec186ccc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments