Sample
Analysis
Goal
document infection chain loading LxBase RAT, extracting it's configuration and unveiling functionality using decrypted strings
Description
The batch script begins by constructing file paths with randomly generated filenames in the current user’s %TEMP% directory for two temporary files: one to store extracted PowerShell script and the other to store embedded Base64-encoded payload. These paths are assigned to the "TMPPS"and "TMPENC" variables, respectively. Next, the script locates two embedded sections within its own body, delimited by the "---BEGIN_PS---"and "---BEGIN_ENC---"markers, and extracts them into the corresponding temporary files.
Recommended Tools
cyerchef de-obfuscation dnspy powershell process injection
Comments
Please login to view and post comments.