MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LxBaseRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930
SHA3-384 hash: 6b524befc9b7291ff708885ba70fea37ed4173408cedeffc1b39aaf34ce059ba9182da483a3313cd13acc7142af0ed85
SHA1 hash: 0234ffa81b292445b9e710591cd8ff0155b4d1b7
MD5 hash: 36b83f39d65bf13b68adb626dd9b2672
humanhash: double-ack-carolina-nebraska
File name:Angebotsanfrage_11-Aug-2026.bat
Download: download sample
Signature LxBaseRAT
Create hunting rule
File size:3'151'522 bytes
First seen:2026-08-11 09:15:27 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 6144:QzOISBFpXmFQCc+vWshBj3OcdU5ezFdBXu:cimFQCh7jBXu
TLSH T10BE5795203850BBDF69D0EC4C95B251B21F2E9677D241298EBB32EE7BC3F9849434636
Magika batch
Reporter lowmal3
Tags:bat LxBaseRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ed0f028e-df28-46d3-857b-2a1567d911b8/
Malware family:
n/a
ID:
1
File name:
Angebotsanfrage.zip
Verdict:
Malicious activity
Analysis date:
2026-08-11 09:02:44 UTC
Tags:
evasion ip-check stealer xworm rat rmrlx susp-powershell wmi-base64
Link:
https://app.any.run/tasks/caf1408f-df22-45b7-a3e0-5f3ed7db19e9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/80273/
Detection(s):
YARA.SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Connection attempt
Running batch commands
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file in the %temp% subdirectories
Creating a file
Creating a process from a recently created file
Deleting a recently created file
Сreating synchronization primitives
DNS request
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
cmd lolbin obfuscated
Link:
https://www.filescan.io/uploads/6a7ae837ac690aab81136f34/reports/6821f8c6-ce67-4b2f-a4da-2ca963f5c26c/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-11T02:05:00Z UTC
Last seen:
2026-08-12T06:25:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930/results?tab=lookup
Result
Threat name:
Clipboard Hijacker, LxBase RAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1955782
Signature
AI detected malicious Powershell script
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Encrypted powershell cmdline option found
Found large BAT file
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Obfuscated command line found
Sample uses string decryption to hide its real strings
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Execution of Powershell Script in Public Folder
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious execution chain found
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected Clipboard Hijacker
Yara detected LxBase RAT
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1955782 Sample: Angebotsanfrage_11-Aug-2026.bat Startdate: 11/08/2026 Architecture: WINDOWS Score: 100 68 Found malware configuration 2->68 70 Malicious sample detected (through community Yara rule) 2->70 72 Yara detected LxBase RAT 2->72 74 12 other signatures 2->74 12 cmd.exe 1 2->12         started        process3 signatures4 82 Suspicious powershell command line found 12->82 84 Obfuscated command line found 12->84 86 Uses ping.exe to sleep 12->86 88 3 other signatures 12->88 15 powershell.exe 12 12->15         started        18 conhost.exe 12->18         started        process5 signatures6 94 Found many strings related to Crypto-Wallets (likely being stolen) 15->94 96 Suspicious execution chain found 15->96 98 Found suspicious powershell code related to unpacking or dynamic code loading 15->98 20 cmd.exe 1 15->20         started        process7 signatures8 76 Suspicious powershell command line found 20->76 78 Encrypted powershell cmdline option found 20->78 23 powershell.exe 26 20->23         started        27 conhost.exe 20->27         started        process9 file10 54 C:\Users\user\AppData\...\l0tehgkzmht.cmd, DOS 23->54 dropped 80 Loading BitLocker PowerShell Module 23->80 29 cmd.exe 1 23->29         started        signatures11 process12 signatures13 90 Obfuscated command line found 29->90 92 Uses ping.exe to sleep 29->92 32 powershell.exe 20 29->32         started        36 PING.EXE 1 29->36         started        39 powershell.exe 8 29->39         started        process14 dnsIp15 50 C:\Users\user\AppData\...\b1yf3pzh.cmdline, Unicode 32->50 dropped 60 Found many strings related to Crypto-Wallets (likely being stolen) 32->60 62 Writes to foreign memory regions 32->62 64 Modifies the context of a thread in another process (thread injection) 32->64 66 Injects a PE file into a foreign processes 32->66 41 csc.exe 3 32->41         started        44 RegAsm.exe 1 32->44         started        46 conhost.exe 32->46         started        58 127.0.0.1 unknown unknown 36->58 52 C:\Users\Public\10059q30231.ps1, ASCII 39->52 dropped file16 signatures17 process18 file19 56 C:\Users\user\AppData\Local\...\b1yf3pzh.dll, PE32 41->56 dropped 48 cvtres.exe 1 41->48         started        process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jcraailm3kr6xcpyuu676gdbn6nz7zc63dw2kdyruz3doxgezeya._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
collection discovery execution spyware stealer upx
Link:
https://tria.ge/reports/260811-k785zszdqf/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
Executes a command shell one-liner
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetThreadContext
UPX packed file
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/48a200216cdaa3eb89f8a53dff18616f9b9fe45ed8eda50f11a676375cc4c930

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:ClamAV_Emotet_String_Aggregate
Create hunting rule
Rule name:SUSP_PS1_JAB_Pattern_Jun22_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable
Reference:Internal Research
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/80273/

Comments