MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165
SHA3-384 hash: 7eb6665eec2eaa98b3cf126c0bd9ee2dd89385cfaeb445300668ea576e99fbe23f345cd952db1bc22eb2b231f729d55f
SHA1 hash: 83b1a8939bd4e2ea5677d8742edd1a697edd196b
MD5 hash: 08e5f1243ad4970745975b27b6e2f9fa
humanhash: nine-papa-eight-violet
File name:08e5f1243ad4970745975b27b6e2f9fa.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:490'496 bytes
First seen:2024-04-05 12:00:27 UTC
Last seen:2024-04-05 12:24:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1691b1f290a2ca836b091bdcee4ba1dd (2 x Rhadamanthys)
ssdeep 12288:/rrb2iDiSOv4VBHMQhPDmqTCYw4oUGbjnm:/7DB/DDm1YANPnm
Threatray 117 similar samples on MalwareBazaar
TLSH T1DDA46B62BBF59D88CD5D33F3C8506BE5065A433642F3E3885D286A52673F6698B0B13C
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10523/12/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter abuse_ch
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
2
# of downloads :
320
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb.exe
Verdict:
Malicious activity
Analysis date:
2024-04-04 19:15:07 UTC
Tags:
loader smoke smokeloader stealer rhadamanthys
Link:
https://app.any.run/tasks/f41436f9-e63f-4b4b-a54f-d6b42d514f54

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
xpack
Link:
https://www.filescan.io/uploads/660fe802d463a7b047811dac/reports/b40a5025-9821-45a9-97ba-f6cdff641f76/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a9e14b9d-6ba3-4df3-b429-ea50ce7ed284
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1420830
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165/
Threat name:
Win32.Trojan.Rhadamanthys
Create hunting rule
Status:
Malicious
First seen:
2024-04-05 12:01:06 UTC
File Type:
PE (Exe)
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=audum5nqp7vy45kwywxujh26m57a7k73bgytlfy27oyroq57gfsq._file
Verdict:
malicious
Similar samples:
07fc70e17fc81a62cce3afd89755eb174e090bb3c0f170ea23a55ac7cdda1820
Rhadamanthys
12d3dc8a4fd8a2ebe6a839cce59920156d55e8d06fe2a5c95ad60419086877bb
Rhadamanthys
488c331d38619439353960f4142748daeee729fb73f9535ba550aa6c830a0c7f
Rhadamanthys
70a7c05b84920869900bfb4d677f13d57ced658d907d495a1ffe66e1b0d420da
Rhadamanthys
7956d6d4b29d847f69e99363771fbe91983f4311b407e13860a025ab20869d90
Rhadamanthys
a62a2d2bf6bce86b9a0bf8a43ae74004f94e5e712400a68d2cc062ec72e1fc78
Rhadamanthys
ab88782dc6c55b7ad16a2f49215158e57d08f8f040be63f4fe0d0c42fcdd8473
Rhadamanthys
+ 107 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240405-n6vsrabc8x/
Unpacked files
SH256 hash:
05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165
MD5 hash:
08e5f1243ad4970745975b27b6e2f9fa
SHA1 hash:
83b1a8939bd4e2ea5677d8742edd1a697edd196b
Link:
https://www.unpac.me/results/cf3cf201-48c7-4888-83cb-8869605140cb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.84
Link:
https://yomi.yoroi.company/submissions/05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::GetStartupInfoA
WIN_BASE_IO_APICan Create FilesVERSION.dll::GetFileVersionInfoSizeW
VERSION.dll::GetFileVersionInfoW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::CreateMenu
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments