MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64f146cd4f35b6a978c1069b78b6953fcec38bd4ccf2514c206c5d16ed264dd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LxBaseRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64f146cd4f35b6a978c1069b78b6953fcec38bd4ccf2514c206c5d16ed264dd1
SHA3-384 hash: 2e3574341968c95f8ec29bb1c9f8efbd8c79689a32defd71157270f8968d13c9db25cd8f77c7f498ec18374c8540a41f
SHA1 hash: d9498a28a7d285901b1d3a7a9138b6fb6b42800c
MD5 hash: bc6432a551c3ecfaf633862a0650d082
humanhash: lithium-equal-kilo-friend
File name:PO _6r738 MY.js
Download: download sample
Signature LxBaseRAT
Create hunting rule
File size:785'020 bytes
First seen:2026-08-04 09:04:17 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 12288:q4wjnm48nI+q2YtyUj1b1yEa/TrWSdoZs2wb5g+0SUth:q4wDmeyUh5yE4VdoZYb5g+0SUth
TLSH T123F48D3B20F59931568DD0BFD3075BA9C2D0E98C1D626F6F64F49E923ED71029E82B06
Magika javascript
Reporter abuse_ch
Tags:js LxBaseRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Other.Malware-gen.41547188.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Labled as:
Trojan.JS.Downloader.JS
Link:
https://www.hybrid-analysis.com/sample/64f146cd4f35b6a978c1069b78b6953fcec38bd4ccf2514c206c5d16ed264dd1
Verdict:
Malicious
File Type:
js
First seen:
2026-08-04T03:36:00Z UTC
Last seen:
2026-08-05T07:06:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/64f146cd4f35b6a978c1069b78b6953fcec38bd4ccf2514c206c5d16ed264dd1/results?tab=lookup
Result
Threat name:
Clipboard Hijacker, Discord Token Steale
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1951804
Signature
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Creates a thread in another existing process (thread injection)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
JScript performs obfuscated calls to suspicious functions
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential evasive JS / VBS script found (domain check)
Sample uses string decryption to hide its real strings
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Silenttrinity Stager Msbuild Activity
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: WScript or CScript Dropper - File
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Windows Shell Script Host drops VBS files
Writes to foreign memory regions
Wscript called in batch mode (surpress errors)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Clipboard Hijacker
Yara detected Discord Token Stealer
Yara detected LxBase RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1951804 Sample: PO _6r738 MY.js Startdate: 04/08/2026 Architecture: WINDOWS Score: 100 102 pki-goog.l.google.com 2->102 104 mr-b01.tm-azurefd.net 2->104 106 3 other IPs or domains 2->106 134 Suricata IDS alerts for network traffic 2->134 136 Found malware configuration 2->136 138 Multi AV Scanner detection for dropped file 2->138 140 16 other signatures 2->140 11 wscript.exe 1 10 2->11         started        15 wscript.exe 1 2->15         started        17 svchost.exe 2->17         started        signatures3 process4 dnsIp5 86 C:\Users\user\AppData\...\tmp_15480_7ad1, ASCII 11->86 dropped 88 C:\Users\user\AppData\...\svc_87948_7c0a.vbs, ASCII 11->88 dropped 90 C:\Users\user\AppData\...\run_89212_7ad1, ASCII 11->90 dropped 92 3 other malicious files 11->92 dropped 170 JScript performs obfuscated calls to suspicious functions 11->170 172 Suspicious powershell command line found 11->172 174 Wscript starts Powershell (via cmd or directly) 11->174 178 5 other signatures 11->178 20 wscript.exe 1 11->20         started        176 WScript reads language and country specific registry keys (likely country aware script) 15->176 23 wscript.exe 6 15->23         started        100 127.0.0.1 unknown unknown 17->100 file6 signatures7 process8 file9 142 Suspicious powershell command line found 20->142 144 Wscript starts Powershell (via cmd or directly) 20->144 146 WScript reads language and country specific registry keys (likely country aware script) 20->146 26 powershell.exe 21 20->26         started        74 C:\Users\user\AppData\...\tmp_83150_a221.vbs, ASCII 23->74 dropped 76 C:\Users\user\AppData\...\net_109923_a174.ps1, C 23->76 dropped 78 C:\Users\user\AppData\...\net_103751_a174, ASCII 23->78 dropped 80 C:\Users\user\AppData\...\clr_31979_a174, ASCII 23->80 dropped 148 Windows Shell Script Host drops VBS files 23->148 30 wscript.exe 23->30         started        signatures10 process11 file12 84 C:\Users\user\AppData\...\as51axtd.cmdline, Unicode 26->84 dropped 150 Found many strings related to Crypto-Wallets (likely being stolen) 26->150 152 Writes to foreign memory regions 26->152 154 Modifies the context of a thread in another process (thread injection) 26->154 156 Injects a PE file into a foreign processes 26->156 32 MSBuild.exe 14 24 26->32         started        37 conhost.exe 26->37         started        39 csc.exe 3 26->39         started        158 Suspicious powershell command line found 30->158 160 Wscript starts Powershell (via cmd or directly) 30->160 162 WScript reads language and country specific registry keys (likely country aware script) 30->162 41 powershell.exe 30->41         started        signatures13 process14 dnsIp15 96 64.89.160.127, 4561, 49719 GHOSTYNETWORKSUS Luxembourg 32->96 98 ip-api.com 208.95.112.1, 49720, 80 TUT-AS-TotalUptimeTechnologiesLLCUS United States 32->98 70 C:\Users\user\AppData\Local\...\msasn1.dll, PE32+ 32->70 dropped 118 Tries to steal Mail credentials (via file / registry access) 32->118 120 Found many strings related to Crypto-Wallets (likely being stolen) 32->120 122 Tries to harvest and steal browser information (history, passwords, etc) 32->122 124 Creates a thread in another existing process (thread injection) 32->124 43 chrome.exe 32->43         started        46 chrome.exe 32->46         started        49 chrome.exe 32->49         started        60 29 other processes 32->60 126 Installs a global keyboard hook 37->126 72 C:\Users\user\AppData\Local\...\as51axtd.dll, PE32 39->72 dropped 51 cvtres.exe 1 39->51         started        128 Writes to foreign memory regions 41->128 130 Modifies the context of a thread in another process (thread injection) 41->130 132 Injects a PE file into a foreign processes 41->132 53 conhost.exe 41->53         started        55 MSBuild.exe 41->55         started        57 csc.exe 41->57         started        file16 signatures17 process18 dnsIp19 164 Suspicious powershell command line found 43->164 166 Suspicious execution chain found 43->166 108 192.168.2.9, 138, 443, 4561 unknown unknown 46->108 110 192.168.2.6 unknown unknown 46->110 62 chrome.exe 46->62         started        66 chrome.exe 46->66         started        168 Installs a global keyboard hook 53->168 82 C:\Users\user\AppData\Local\...\oocuzbwj.dll, PE32 57->82 dropped 68 cvtres.exe 57->68         started        file20 signatures21 process22 dnsIp23 112 www.google.com 142.251.150.119, 443, 49722, 49723 GOOGLE-GoogleLLCUS United States 62->112 114 142.251.151.119, 443, 49748, 49749 GOOGLE-GoogleLLCUS United States 62->114 116 7 other IPs or domains 62->116 94 Chrome Cache Entry: 523, PDP-11 62->94 dropped file24
Score:
57%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/64f146cd4f35b6a978c1069b78b6953fcec38bd4ccf2514c206c5d16ed264dd1
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/64f146cd4f35b6a978c1069b78b6953fcec38bd4ccf2514c206c5d16ed264dd1/
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-04 09:34:32 UTC
File Type:
Text (JavaScript)
AV detection:
9 of 24 (37.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mtyuntkpgw3ks6gba2nxrnuvh7hmhc6uztzfctbanrorn3jgjxiq._file
Result
Malware family:
lxbaserat
Create hunting rule
Score:
  10/10
Tags:
family:lxbaserat botnet:group1 campaign:0e88bdb59f4f4644a31d22e3c4d7da63 collection discovery execution persistence rat upx
Link:
https://tria.ge/reports/260804-k1w7vage93/
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Executes a VBScript file via the Windows Script Host.
Suspicious use of SetThreadContext
UPX packed file
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Command and Scripting Interpreter: PowerShell
Family: LxBaseRAT
Malware Config
C2 Extraction:
64.89.160.127:4561
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/64f146cd4f35b6a978c1069b78b6953fcec38bd4ccf2514c206c5d16ed264dd1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_obfuscated_JS_obfuscatorio
Create hunting rule
Author:@imp0rtp3
Description:Detect JS obfuscation done by the js obfuscator (often malicious)
Reference:https://obfuscator.io
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments