Excerpt
10 min read
Jul 15, 2026
During a recent malware analysis, I encountered an interesting sample (
an embedded PowerShell script and Base64-encoded payload that ultimately deploys the sophisticated LxBase .NET RAT. This blog dissects each stage of the infection chain, from initial batch loader and embedded PowerShell scripts to in-memory loading of the final .NET payload followed by an in-depth analysis of the RA capabilities.
: A Technical Deep Dive
SHA-
), a batch-script loader containing
T’s…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Medium on medium.com.
More from Medium19
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
- Reverse Engineering the Auto-Color Linux BackdoorMedium · Published 30 Aug
- 1337_GTWK Linux Malware AnalysisMedium · Published 30 Jul
- MetaStealer traffic, new DGAs and analyzing the “tracker” backdoor DGA with AIMedium · Published 17 Jun
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
