MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 375ac09d5f44849e9c888e86adc50069cdb019e3de3216264f61868bef12ca4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments 1

SHA256 hash:	375ac09d5f44849e9c888e86adc50069cdb019e3de3216264f61868bef12ca4d
SHA3-384 hash:	51afee09eadedcc62f977f166e41fb4da884b3d0f41eb34788bcac4ecc8ef94f01b15804b62007e981faa4fdd0877a4a
SHA1 hash:	7b71dfa4da23b81f681241cc642050d1c9085848
MD5 hash:	1b298f950d9b3289188e0ae035ac4095
humanhash:	delaware-butter-hawaii-happy
File name:	DRBS7505.lnk
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	130'105 bytes
First seen:	2024-04-09 17:26:18 UTC
Last seen:	2024-04-10 16:45:35 UTC
File type:	lnk
MIME type:	application/octet-stream
ssdeep	3072:UhX0NlDzCHH36SEn/iAgUrQCIS9D1YnKvbDT+jeo1lhU3uBr:fNlfCmjrQCID4bDOeWN
TLSH	T186D312373444AE6BD4B35BF49F28BEE0CCC2B83E7CA5313C64A584232B2FA166455539
Reporter	smica83
Tags:	care-onboard.com lnk Rhadamanthys SVK

Intelligence

File Origin

# of uploads :

# of downloads :

174

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malicious

File Type:

LNK File - Malicious

Link:

https://app.docguard.net/375ac09d5f44849e9c888e86adc50069cdb019e3de3216264f61868bef12ca4d/results/dashboard

Payload URLs

URL

File name

https://care-onboard.com/app.txt

LNK File

Behaviour

BlacklistAPI detected

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

evasive masquerade

Link:

https://www.filescan.io/uploads/66157a68f4fe020219b44700/reports/2d34e938-41c5-451b-ade9-744db3e6db77/overview

Verdict:

Malicious

Labled as:

BZC.YAX.Boxter.111

Link:

https://www.hybrid-analysis.com/sample/375ac09d5f44849e9c888e86adc50069cdb019e3de3216264f61868bef12ca4d

Result

Verdict:

MALICIOUS

Details

Hidden Powershell

Detected a pivot to Powershell that utilizes commonly nefarious attributes such as '-windowstyle hidden'.

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1423216

Signature

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

Encrypted powershell cmdline option found

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious PowerShell Parameter Substring

Snort IDS alert for network traffic

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows shortcut file (LNK) starts blacklisted processes

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/375ac09d5f44849e9c888e86adc50069cdb019e3de3216264f61868bef12ca4d/

Threat name:

Shortcut.Trojan.Rhadamanthys

Status:

Malicious

First seen:

2024-04-09 12:08:46 UTC

File Type:

Binary

Extracted files:

AV detection:

14 of 38 (36.84%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g5nmbhk7iscj5heir2dk3rianhg3agpd3yzbmjspmgdix3yszjgq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/240409-v1eb5sha6w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Blocklisted process makes network request

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/375ac09d5f44/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/375ac09d5f44849e9c888e86adc50069cdb019e3de3216264f61868bef12ca4d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	EXE_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies executable artefacts in shortcut (LNK) files.

Rule name:	High_Entropy_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies shortcut (LNK) file with equal or higher entropy than 6.5. Most goodware LNK files have a low entropy, lower than 6.

Rule name:	Large_filesize_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies shortcut (LNK) file larger than 100KB. Most goodware LNK files are smaller than 100KB.

Rule name:	Long_RelativePath_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies shortcut (LNK) file with a long relative path. Might be used in an attempt to hide the path.

Rule name:	PS_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies PowerShell artefacts in shortcut (LNK) files.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

Szabolcs Schmidt commented on 2024-04-09 17:41:24 UTC

hxxps://care-onboard(.)com/app.txt