MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fb42ac549ed871380bc87eea94cd6b63f21925eafa5f675fafb3407bfbf4792. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BitterElephant


Vendor detections: 10


Intelligence 10 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8fb42ac549ed871380bc87eea94cd6b63f21925eafa5f675fafb3407bfbf4792
SHA3-384 hash: bb0060d24f21e82bed70b6ae38f5393cb9ac6ba0bffa5b7a6de652437928444d928301871768753c8f8317b82c63f173
SHA1 hash: adcdc6540501e44aa92087e6f18c7c57a8fb6c1f
MD5 hash: 46f4b869022b9aca457ab6fd56e35016
humanhash: two-spaghetti-hawaii-uniform
File name:Document.pdf.lnk
Download: download sample
Signature BitterElephant
Create hunting rule
File size:542'494 bytes
First seen:2024-09-22 05:22:02 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/octet-stream
ssdeep 12288:Neysqu7j58ONkS79NzEW1rK6ajoap49ER95TZ0O6U:NQF5XNRnzP1reBTqw
TLSH T1BBB4239B73B025B9D071E43288D29C3BB537323E96F266E50C6C78457B968086452FEF
Magika lnk
Reporter abuse_ch
Tags:BitterElephant lnk

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.74169062.4113.18602.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66efa97f8aca58c2b2c697ba
Tags:
Multi Robin
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/8fb42ac549ed871380bc87eea94cd6b63f21925eafa5f675fafb3407bfbf4792/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
conhost evasive masquerade miner
Link:
https://www.filescan.io/uploads/66efa97f33910721661e6a45/reports/50849ba1-7872-4f52-9b53-cf71addd0379/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/8fb42ac549ed871380bc87eea94cd6b63f21925eafa5f675fafb3407bfbf4792
Result
Verdict:
MALICIOUS
Result
Threat name:
Bitter Elephant
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1515291
Signature
AI detected suspicious sample
Multi AV Scanner detection for submitted file
Passes commands via pipe to a shell (likely to bypass AV or HIPS)
Sigma detected: Curl Download And Execute Combination
Sigma detected: Schedule system process
Sigma detected: Suspicious Command Patterns In Scheduled Task Creation
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows shortcut file (LNK) contains suspicious command line arguments
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Bitter Elephant
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1515291 Sample: Document.pdf.lnk Startdate: 22/09/2024 Architecture: WINDOWS Score: 100 33 www.mcxntoolsservice.com 2->33 35 mcxntoolsservice.com 2->35 37 Windows shortcut file (LNK) starts blacklisted processes 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 Yara detected Bitter Elephant 2->41 43 7 other signatures 2->43 8 ssh.exe 2 2->8         started        11 cmd.exe 1 2->11         started        signatures3 process4 signatures5 45 Windows shortcut file (LNK) starts blacklisted processes 8->45 47 Passes commands via pipe to a shell (likely to bypass AV or HIPS) 8->47 13 cmd.exe 1 8->13         started        16 curl.exe 2 11->16         started        19 cmd.exe 1 11->19         started        21 more.com 1 11->21         started        process6 dnsIp7 49 Uses schtasks.exe or at.exe to add and modify task schedules 13->49 23 schtasks.exe 1 13->23         started        25 msg.exe 1 13->25         started        27 timeout.exe 1 13->27         started        29 mcxntoolsservice.com 188.241.39.200, 443, 49706 BANDWIDTH-ASGB Belize 16->29 31 127.0.0.1 unknown unknown 16->31 signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8fb42ac549ed871380bc87eea94cd6b63f21925eafa5f675fafb3407bfbf4792/
Threat name:
Shortcut.Trojan.Rasprobin
Create hunting rule
Status:
Suspicious
First seen:
2024-09-13 12:28:25 UTC
File Type:
Binary
Extracted files:
1
AV detection:
9 of 38 (23.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r62cvrkj5wdrhaf4q7xkstgwwy7sdes6v6s7m5p27m2app57i6ja._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/240922-f2lehstdkq/
Behaviour
Delays execution with timeout.exe
Scheduled Task/Job: Scheduled Task
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Checks computer location settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8fb42ac549ed871380bc87eea94cd6b63f21925eafa5f675fafb3407bfbf4792

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Download_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies download artefacts in shortcut (LNK) files.
Rule name:EXE_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies executable artefacts in shortcut (LNK) files.
Rule name:High_Entropy_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies shortcut (LNK) file with equal or higher entropy than 6.5. Most goodware LNK files have a low entropy, lower than 6.
Rule name:Large_filesize_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies shortcut (LNK) file larger than 100KB. Most goodware LNK files are smaller than 100KB.
Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_Big_Link_File
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a suspiciously big LNK file - maybe with embedded content
Reference:Internal Research
Rule name:SUSP_LNK_Big_Link_File_RID2EDD
Create hunting rule
Author:Florian Roth
Description:Detects a suspiciously big LNK file - maybe with embedded content
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments