MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08f8032cf853b669a798b2ba1a6d69abea1e60fb1c758281abb6c81635017740. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	08f8032cf853b669a798b2ba1a6d69abea1e60fb1c758281abb6c81635017740
SHA3-384 hash:	d9235ef08f8cd7e17dc285c9aa19968d5e85e5696b1b5d0c36b1ad160c3385cd7fdc1aa57f981589325b959e35c16513
SHA1 hash:	3e5d764568c4e646c707192bc432345e47580032
MD5 hash:	1c625dcc6ff9441dd7f64cd0fdf8d274
humanhash:	papa-mango-angel-saturn
File name:	file
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	370'176 bytes
First seen:	2023-03-06 14:56:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0309f345269cd9af3b42f8f4aa807e76 (3 x Gozi, 3 x Smoke Loader, 1 x Rhadamanthys)
ssdeep	6144:Q3MuLzwEckNRoNpYCcAsqjXKhk/eG7LJsI6UW:yPwEcdrbbsKXleGPJsI6
Threatray	244 similar samples on MalwareBazaar
TLSH	T15074E01231E0C4F3C45B01B75832DEA1EB7EB461FB65868773942BBE1E206E15A3735A
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	001edeca86a48c84 (1 x Rhadamanthys)
Reporter	jstrosch
Tags:	exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

225

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2023-03-06 14:59:07 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/8f8850ee-3092-4bbb-88f5-30ce2e88eefe

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/372031/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Unauthorized injection to a recently created process

Сreating synchronization primitives

Sending an HTTP GET request

Creating a file in the %AppData% directory

Launching a process

Deleting a recently created file

Sending a custom TCP request

Reading critical registry keys

Launching the default Windows debugger (dwwin.exe)

Forced system process termination

Stealing user critical data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

75%

Tags:

greyware

Link:

https://www.filescan.io/uploads/6405ff4166e79c93ba0e3fc3/reports/3c74e734-8659-428e-9a25-84542babb61c/overview

Verdict:

Malicious

Labled as:

Ransom.84989A88

Link:

https://www.hybrid-analysis.com/sample/08f8032cf853b669a798b2ba1a6d69abea1e60fb1c758281abb6c81635017740

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Cobalt Strike

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0f108023-154b-4cd2-9fc9-1c6eda8c89f8

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1188014

Signature

Antivirus detection for URL or domain

Contain functionality to detect virtual machines

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to hide a thread from the debugger

Contains functionality to inject code into remote processes

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found API chain indicative of debugger detection

Found potential ransomware demand text

Injects a PE file into a foreign processes

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Searches for specific processes (likely to inject)

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/08f8032cf853b669a798b2ba1a6d69abea1e60fb1c758281abb6c81635017740/

Threat name:

Win32.Infostealer.Rhadamanthus

Status:

Malicious

First seen:

2023-03-06 15:07:01 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 25 (76.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bd4aglhyko3gtj4ywk5bu3ljvpvb4yh3dr2yfanlw3ebmnibo5aa._file

Verdict:

malicious

Label(s):

cobaltstrike

Rhadamanthys

27966f9978a1ed77868b2d7827ff6581d6da7110421bd6179fc5ccca21e65060

Rhadamanthys

304807387b994a646c2a989dc20b08fd51cf0b5c2f3181068421fc201411116f

Rhadamanthys

64d1d03c3378be695f30daea3877b732f662fc453dcd03af0f7990467c698a8f

Rhadamanthys

7a51c9c3a7b0fd2514c4e774f623c59c2fe305a0f8d75ab8c51005bbc6deea52

Rhadamanthys

81ec316a2df6429425c8686cac4cccf3e96835ad4f3b4454fd9d96ee0765e6b0

Rhadamanthys

a860f0a0550d4e011d2fa244f01892f163d218f036c273e78851ab383d361843

Rhadamanthys

d85d8e7789de173ab6af6cddbd31fe5c024987627abfa8ae0f42f6e995d1f205

Rhadamanthys

fd19241e3dbb2519f4f10b8e415e5dee056a7f2894bd7b0e7000a544147caf0a

Rhadamanthys

+ 234 additional samples on MalwareBazaar

Result

Malware family:

rhadamanthys

Score:

10/10

Tags:

family:rhadamanthys collection discovery spyware stealer

Link:

https://tria.ge/reports/230306-sbkrhsch58/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Detect rhadamanthys stealer shellcode

Rhadamanthys

Unpacked files

SH256 hash:

9c0bd64e8888569d9f394853aade64392c431a684452d9bc8f819dfb2d1bac1a

MD5 hash:

016615af8b3cb0a90066b3bedcf65aa9

SHA1 hash:

315dd04a70f9bcc2b62b57846dbfa79426eb5856

Link:

https://www.unpac.me/results/16469ef7-6f1f-4618-9c4e-79be17c32fd5/

SH256 hash:

08f8032cf853b669a798b2ba1a6d69abea1e60fb1c758281abb6c81635017740

MD5 hash:

1c625dcc6ff9441dd7f64cd0fdf8d274

SHA1 hash:

3e5d764568c4e646c707192bc432345e47580032

Link:

https://www.unpac.me/results/16469ef7-6f1f-4618-9c4e-79be17c32fd5/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/08f8032cf853/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/08f8032cf853b669a798b2ba1a6d69abea1e60fb1c758281abb6c81635017740

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.