MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fdf7a0903d90eacf2a689840cd85fafadb45fd009eec03a64e0c35e0e501af2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5fdf7a0903d90eacf2a689840cd85fafadb45fd009eec03a64e0c35e0e501af2
SHA3-384 hash:	2fa9922f876b70ff683f7327f9e788a3f8f705517d550dfe2ec62cb5ca118c1a9c8163f4babcdee38831e3a07a1e0b37
SHA1 hash:	140a00a191927e3383962deb5dbe4eafbf3a4404
MD5 hash:	ca980ca754a9b4bac92a797c5c915ca5
humanhash:	minnesota-louisiana-minnesota-pip
File name:	angebotsanfrage_11-aug-2026.rar
Download:	download sample
Signature	LxBaseRAT Alert Create hunting rule
File size:	1'142'466 bytes
First seen:	2026-08-11 17:59:08 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	24576:Gj7fRkkybB2N4iqDDpbMgDEUsexfno0aNhzVvrwBG45ld:qKvbB3DDDpbMcdxftIvUG45ld
TLSH	T1AA3533FEC227C5EE1ED9310A29B988DF26122EF568D9B1250E15F6F25FF24188507CC9
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	k3dg3___
Tags:	LxBaseRAT rar

k3dg3

Version: 1.0.28
Executable: client.exe
Campaign_ID: Group1
C2: privatehos.casacam.net
Port: 62769
Mutex: 190d19de85bf4400832aacb5a3b2e49f

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

35

Origin country :

US

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/83720f85-4392-4448-b7c6-ff060b57eff2/

ClamAV Detected

Detection(s):

YARA.SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/5fdf7a0903d90eacf2a689840cd85fafadb45fd009eec03a64e0c35e0e501af2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-08-11T15:58:00Z UTC

Last seen:

2026-08-13T14:02:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5fdf7a0903d90eacf2a689840cd85fafadb45fd009eec03a64e0c35e0e501af2/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5fdf7a0903d90eacf2a689840cd85fafadb45fd009eec03a64e0c35e0e501af2/

ReversingLabs TitaniumCloud Binary.Trojan.Generic

Threat name:

Binary.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-08-11 09:00:34 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l7pxucid3ehkz4vgrgcazwc7v6w3ix6qbhxmaote4dbv4dsqdlza._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection discovery execution spyware stealer upx

Link:

https://tria.ge/reports/260811-xxw4wsbn31/

Behaviour

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Executes a command shell one-liner

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of SetThreadContext

UPX packed file

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Loads dropped DLL

Reads user/profile data of web browsers

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5fdf7a0903d90eacf2a689840cd85fafadb45fd009eec03a64e0c35e0e501af2