Executive Summary
Analysis reveals a complex infection chain attributed to the RMRLX family, deploying the LxBaseRAT malware. The attack begins with highly obfuscated JavaScript that utilizes environment fingerprinting and a state-machine dispatcher to evade automated analysis. This stage eventually drops a VBScript launcher that triggers a hidden PowerShell script, which compiles and executes the final .NET payload in memory using living-off-the-land binaries like csc.exe and MSBuild.exe.
The final payload, LxBaseRAT, is a versatile Remote Access Trojan and information stealer. It is capable of exfiltrating credentials from multiple browsers (Edge, Chrome, Brave), stealing cryptocurrency wallets (Exodus, WalletWasabi), harvesting Discord tokens, and performing keylogging. Furthermore, the malware features advanced capabilities such as Hidden Virtual Network Computing (HVNC) for remote desktop access and various process injection techniques for stealthy execution.
This threat is significant due to its extensive evasion techniques and high-impact data theft capabilities. Organizations should prioritize monitoring for suspicious PowerShell execution policies and unauthorized use of .NET compilers on endpoints. The malware ensures persistence via hidden Scheduled Tasks masquerading as legitimate Microsoft Edge updates, making long-term compromise likely if not detected.