MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8de3d851efc7e0d42da0ecbc656ab93362595101d30b36ce36b7d698cdd99cd0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8de3d851efc7e0d42da0ecbc656ab93362595101d30b36ce36b7d698cdd99cd0
SHA3-384 hash:	d7fe57b15e3afca5a439e748a38c17ade8d45e74cff712c8a51b67c06c3d6d542f556cd031aff3c2a9c5de38ac8bcfb4
SHA1 hash:	db39be662ffcbaad7a874bbe03c9c32d6455cbaf
MD5 hash:	1f58d6a4690fd06dcbf2215f4f4dae7b
humanhash:	xray-hamper-football-nebraska
File name:	loader.ps1
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	399 bytes
First seen:	2024-12-04 12:46:15 UTC
Last seen:	2024-12-04 12:46:47 UTC
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	12:0G81kTQJrDheJSylFt1M40WFxF52JrDheb9lsiwP:0G4ml2kzDyA9ljy
TLSH	T1DEE0C06202B8A305CD308038E3F22F83F247B3878043BB925105B58CA59D04F7AEC401
Magika	txt
Reporter	JAMESWT_WT
Tags:	95-169-201-100 bat Compilazioneprotetticopyright ps1 Rhadamanthys

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

113

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN asyncrat

Malware family:

asyncrat

Alert

Create hunting rule

ID:

1

File name:

Documenti relativi alla violazione dei diritti di proprietà intellettuale.lnk

Verdict:

Malicious activity

Analysis date:

2024-12-04 12:41:44 UTC

Tags:

loader rhadamanthys stealer rat asyncrat remote

Link:

https://app.any.run/tasks/a558bfcd-9d18-465e-a78a-a8bd10c4f8ac

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.Heur.BZC.ONG.Boxter.371.5694AF26.15241.21804.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=675051b312e85e185e75a94a

Tags:

gumen shell agent sage

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Сreating synchronization primitives

Connection attempt

Sending an HTTP GET request

Creating a file in the %temp% directory

Creating a process from a recently created file

Searching for the window

Launching the default Windows debugger (dwwin.exe)

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

dropper evasive fingerprint kiosk masquerade packed powershell

Link:

https://www.filescan.io/uploads/67504f49e17bdb6c4d96be74/reports/d8159b4f-5b0c-4925-8293-5b20e5d768ae/overview

Hybrid Analysis BZC.PZQ.Boxter.928

Verdict:

Malicious

Labled as:

BZC.PZQ.Boxter.928

Link:

https://www.hybrid-analysis.com/sample/8de3d851efc7e0d42da0ecbc656ab93362595101d30b36ce36b7d698cdd99cd0

Joe Sandbox RHADAMANTHYS

Result

Threat name:

RHADAMANTHYS

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1568257

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Drops large PE files

Found malware configuration

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Multi AV Scanner detection for dropped file

Powershell drops PE file

Suricata IDS alerts for network traffic

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses known network protocols on non-standard ports

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/8de3d851efc7e0d42da0ecbc656ab93362595101d30b36ce36b7d698cdd99cd0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8de3d851efc7e0d42da0ecbc656ab93362595101d30b36ce36b7d698cdd99cd0/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rxr5quppy7qnilna5s6gk2vzgnrfsuib2mftntrww7ljrtozttia._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/241204-p32ybswkcv/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

Program crash

System Location Discovery: System Language Discovery

Adds Run key to start application

Executes dropped EXE

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Suspicious use of NtCreateUserProcessOtherParentProcess

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8de3d851efc7e0d42da0ecbc656ab93362595101d30b36ce36b7d698cdd99cd0