🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f42808ff4337bf6026e9524cd11dc4877f2492d442b37537e4191724bad63bd0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f42808ff4337bf6026e9524cd11dc4877f2492d442b37537e4191724bad63bd0
SHA3-384 hash: 10fdd70d7a07cd45fb885e5eee3bb293cbdd1b09916f755fdfd9254c99f9b95ceb09a3d958ca7a6aad968ffd036d521f
SHA1 hash: 54ee497246c249e4f3ebf63305ac366b41de0a5a
MD5 hash: c067032840b92220c390ec9458381c1d
humanhash: magnesium-hot-pennsylvania-floor
File name:877477.bat
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:2'976'370 bytes
First seen:2025-11-02 15:45:01 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/plain
ssdeep 49152:sUSmiJ3J1Fv6/cgm/vzMj14vxPW+ZlHdVoNzqU82:d
Threatray 636 similar samples on MalwareBazaar
TLSH T148D512B38E5D96CB53324290F74FEEDCB2C29A19652990CE2B80B5C248D7B8D1B5F315
Magika batch
Reporter smica83
Tags:bat Rhadamanthys

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
877477.bat
Verdict:
No threats detected
Analysis date:
2025-11-02 15:46:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2d0868c7-cc8f-47f4-9535-9c821075c611

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/35021/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69077cc69942f1282ecb76cf
Tags:
vmdetect autorun
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Creating a file in the %temp% directory
Creating a window
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm cmd findstr lolbin obfuscated powershell
Link:
https://www.filescan.io/uploads/69077ca7be20d933485b44ac/reports/6bc3d1ca-d5a7-41ad-8b02-092cd11de174/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f42808ff4337bf6026e9524cd11dc4877f2492d442b37537e4191724bad63bd0
Verdict:
Malicious
File Type:
text
First seen:
2025-11-03T03:57:00Z UTC
Last seen:
2025-11-03T04:09:00Z UTC
Hits:
~10
Detections:
Trojan.BAT.Obfus.bs
Link:
https://opentip.kaspersky.com/f42808ff4337bf6026e9524cd11dc4877f2492d442b37537e4191724bad63bd0/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1806570
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for URL or domain
Deletes itself after installation
Drops script or batch files to the startup folder
Early bird code injection technique detected
Found large BAT file
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
Queues an APC in another process (thread injection)
Sigma detected: Drops script at startup location
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1806570 Sample: 877477.bat Startdate: 02/11/2025 Architecture: WINDOWS Score: 100 182 x.ns.gin.ntt.net 2->182 184 twc.trafficmanager.net 2->184 186 12 other IPs or domains 2->186 210 Antivirus detection for URL or domain 2->210 212 Sigma detected: Drops script at startup location 2->212 214 .NET source code contains potential unpacker 2->214 216 6 other signatures 2->216 15 cmd.exe 1 2->15         started        18 cmd.exe 2->18         started        20 cmd.exe 2->20         started        22 14 other processes 2->22 signatures3 process4 dnsIp5 258 Suspicious powershell command line found 15->258 25 powershell.exe 12 15->25         started        28 conhost.exe 15->28         started        30 powershell.exe 18->30         started        32 conhost.exe 18->32         started        34 powershell.exe 20->34         started        36 conhost.exe 20->36         started        208 127.0.0.1 unknown unknown 22->208 38 powershell.exe 22->38         started        40 conhost.exe 22->40         started        signatures6 process7 signatures8 242 Drops script or batch files to the startup folder 25->242 244 Adds a directory exclusion to Windows Defender 25->244 42 cmd.exe 1 25->42         started        44 cmd.exe 30->44         started        46 cmd.exe 34->46         started        48 cmd.exe 38->48         started        process9 process10 50 powershell.exe 34 42->50         started        54 conhost.exe 42->54         started        62 2 other processes 42->62 56 powershell.exe 44->56         started        64 3 other processes 44->64 58 powershell.exe 46->58         started        66 3 other processes 46->66 60 powershell.exe 48->60         started        68 3 other processes 48->68 file11 156 C:\...behaviorgraphdDIWFXouvZBPmSyjXwOgqgpVphRHh.bat, ASCII 50->156 dropped 158 C:\...behaviorgraphdDIWFXouvZBPmSyjXwOgqgpVphRHh.bat, ASCII 50->158 dropped 160 C:\Users\user\AppData\Local\Temp\877477.bat, ASCII 50->160 dropped 162 C:\Users\user\AppData\Local\Temp\877476.bat, ASCII 50->162 dropped 218 Deletes itself after installation 50->218 220 Adds a directory exclusion to Windows Defender 50->220 70 cmd.exe 1 50->70         started        73 cmd.exe 1 50->73         started        75 powershell.exe 7 50->75         started        77 cmd.exe 56->77         started        79 cmd.exe 56->79         started        81 OpenWith.exe 58->81         started        84 OpenWith.exe 60->84         started        signatures12 process13 dnsIp14 222 Suspicious powershell command line found 70->222 86 powershell.exe 12 70->86         started        88 conhost.exe 70->88         started        90 powershell.exe 12 73->90         started        92 conhost.exe 73->92         started        94 conhost.exe 75->94         started        96 powershell.exe 77->96         started        98 conhost.exe 77->98         started        100 2 other processes 79->100 172 twc.trafficmanager.net 168.61.215.74 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 81->172 174 ntp.time.in.ua 62.149.0.30 COLOCALLInternetDataCenterColoCALLUA Ukraine 81->174 224 Early bird code injection technique detected 81->224 226 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 81->226 228 Tries to steal Mail credentials (via file / registry access) 81->228 230 4 other signatures 81->230 102 2 other processes 81->102 176 104.21.92.158 CLOUDFLARENETUS United States 84->176 178 rorectal.click 84->178 180 arorectal.click 84->180 signatures15 process16 process17 104 cmd.exe 86->104         started        106 cmd.exe 90->106         started        108 cmd.exe 96->108         started        110 cmd.exe 100->110         started        112 chrome.exe 102->112         started        115 chrome.exe 102->115         started        dnsIp18 117 OpenWith.exe 104->117         started        121 powershell.exe 104->121         started        130 4 other processes 104->130 124 powershell.exe 106->124         started        132 3 other processes 106->132 126 powershell.exe 108->126         started        134 3 other processes 108->134 128 powershell.exe 110->128         started        136 3 other processes 110->136 168 googlehosted.l.googleusercontent.com 112->168 170 clients2.googleusercontent.com 112->170 process19 dnsIp20 188 ntp.time.nl 94.198.159.10 SIDNNL Netherlands 117->188 190 198.251.88.63, 38383, 49719, 49727 PONYNETUS United States 117->190 198 6 other IPs or domains 117->198 232 Early bird code injection technique detected 117->232 234 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 117->234 236 Tries to steal Mail credentials (via file / registry access) 117->236 240 4 other signatures 117->240 138 wmpnscfg.exe 117->138         started        141 chrome.exe 117->141         started        143 chrome.exe 117->143         started        164 C:\...\HMqDtgRBSkfVNZQVJUNzcWZwVuYMxe.bat, ASCII 121->164 dropped 145 powershell.exe 121->145         started        166 C:\...\UsLLBQNSiIhKKYenPLQGXaUDpImRsC.bat, ASCII 124->166 dropped 238 Adds a directory exclusion to Windows Defender 124->238 147 powershell.exe 124->147         started        149 OpenWith.exe 126->149         started        152 OpenWith.exe 128->152         started        192 cloudflare-dns.com 104.16.248.249, 443, 49721, 49723 CLOUDFLARENETUS United States 130->192 194 arorectal.click 172.67.191.242, 443, 49722, 49726 CLOUDFLARENETUS United States 130->194 196 rorectal.click 172.67.195.107, 443, 49724, 49743 CLOUDFLARENETUS United States 130->196 file21 signatures22 process23 dnsIp24 246 Writes to foreign memory regions 138->246 248 Allocates memory in foreign processes 138->248 154 conhost.exe 145->154         started        200 time-a-g.nist.gov 129.6.15.28 US-NATIONAL-INSTITUTE-OF-STANDARDS-AND-TECHNOLOGYUS United States 149->200 202 time.facebook.com 129.134.25.123 FACEBOOKUS United States 149->202 250 Early bird code injection technique detected 149->250 252 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 149->252 254 Tries to steal Mail credentials (via file / registry access) 149->254 256 2 other signatures 149->256 204 rorectal.click 152->204 206 arorectal.click 152->206 signatures25 process26
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f42808ff4337bf6026e9524cd11dc4877f2492d442b37537e4191724bad63bd0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f42808ff4337bf6026e9524cd11dc4877f2492d442b37537e4191724bad63bd0/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/f42808ff4337bf6026e9524cd11dc4877f2492d442b37537e4191724bad63bd0
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6quar72dg67wajxjkjgnchoeq57sjewuikzxkn7edelsjowwhpia._file
Verdict:
malicious
Label(s):
unc_loader_040
Create hunting rule
Similar samples:
13f6c9d2b53ff26787837ee6e18e0024682653488ab2a363ecf71b035640d12e
Rhadamanthys
1d5f8dbcd73770c03c1925147dfc4644151c4948186c406c135b409ac17275f2
Rhadamanthys
259548fd502ac150fb83988b9f8c3c49364909a5bea4bf71a168ff63d66f4afd
Rhadamanthys
570d9cde15c653ba533ae9de31882d2befcab80399ec02a3bd21c654db32cb1e
Rhadamanthys
65327df43dc0bcef73f3b04c061764bd6fd8c856fc6a469540d0e4e0100236ae
Rhadamanthys
7272849fb01ebbe8daed5264d778ed569f8ba632ea7b0f5f92f622819f8ef31a
Rhadamanthys
739506a71a7f9f34a2f44202d2fedbde0cde8b47ad4de5a01175905989cc20c4
Rhadamanthys
8c91d3334735df59e3ada740bde1fe67068db279a5c9f0fcf3761361648bf5a1
Rhadamanthys
error
Rhadamanthys
ff01cac434318c68a1a8f54d58e4963f69d8c5ebaa7847c915363067df0c3f5f
Rhadamanthys
+ 626 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution
Link:
https://tria.ge/reports/251102-s7lcxsby8f/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
An obfuscated cmd.exe command-line is typically used to evade detection.
Deletes itself
Drops startup file
Command and Scripting Interpreter: PowerShell
Suspicious use of NtCreateUserProcessOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f42808ff4337bf6026e9524cd11dc4877f2492d442b37537e4191724bad63bd0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/35021/

Comments