MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13153ae03f0fc4c762a29a76840cb5ff889e51776bd80e7970c600306e1931eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13153ae03f0fc4c762a29a76840cb5ff889e51776bd80e7970c600306e1931eb
SHA3-384 hash: 3f5e847b25edce6e195f5e3bd34e05c498b9f6198b95d4cb98cc8ea7ff8ef6ff29d84a033cd94ec976db14cf3a55ea3d
SHA1 hash: 10e44377d75550aa574f2b522c32ecd0a14df90a
MD5 hash: 085e4e146e6d59a89f8da11d37a8cb90
humanhash: violet-video-white-comet
File name:ppi.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:1'891'840 bytes
First seen:2023-03-19 13:39:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 24576:dJnPaiWqL9Ot09OX7l348A5NyxlSuvVUfAC4O9FVP8twASavn1xLcTFeYwRLNj8f:KkIlyUsFeYw1Fz7X+uaA4wU7x
Threatray 33 similar samples on MalwareBazaar
TLSH T11C955CF25193FEC5A76F2D4890042A449C00189797BC969CFCC93A97A3E5574EFACBB0
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter Chainskilabs
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
1
# of downloads :
229
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ppi.exe
Verdict:
Malicious activity
Analysis date:
2023-03-19 13:42:13 UTC
Tags:
rhadamanthys
Link:
https://app.any.run/tasks/b30140b8-6ed1-4600-afb5-4d05cf672189

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/375652/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/641710b5e6d26a096f571c8a/reports/e16cb388-61dc-46ec-9259-e06906e15eb3/overview
Verdict:
Malicious
Labled as:
MSIL.Krypt.Generic
Link:
https://www.hybrid-analysis.com/sample/13153ae03f0fc4c762a29a76840cb5ff889e51776bd80e7970c600306e1931eb
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/dc56adc7-d882-44c1-9762-5099a5d7cb2c
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1197080
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Checks if the current machine is a virtual machine (disk enumeration)
Encrypted powershell cmdline option found
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 829981 Sample: ppi.exe Startdate: 19/03/2023 Architecture: WINDOWS Score: 100 24 Snort IDS alert for network traffic 2->24 26 Multi AV Scanner detection for domain / URL 2->26 28 Antivirus detection for URL or domain 2->28 30 7 other signatures 2->30 7 ppi.exe 5 2->7         started        process3 file4 22 C:\Users\user\AppData\Local\...\ppi.exe.log, ASCII 7->22 dropped 32 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->32 34 Encrypted powershell cmdline option found 7->34 36 Writes to foreign memory regions 7->36 38 Injects a PE file into a foreign processes 7->38 11 RegAsm.exe 7->11         started        14 RegAsm.exe 7->14         started        16 powershell.exe 16 7->16         started        18 RegAsm.exe 7->18         started        signatures5 process6 signatures7 40 Query firmware table information (likely to detect VMs) 11->40 42 Hides threads from debuggers 11->42 44 Checks if the current machine is a virtual machine (disk enumeration) 11->44 46 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 14->46 48 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 14->48 50 Queries memory information (via WMI often done to detect virtual machines) 14->50 20 conhost.exe 16->20         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13153ae03f0fc4c762a29a76840cb5ff889e51776bd80e7970c600306e1931eb/
Threat name:
ByteCode-MSIL.Spyware.Rhadamanthys
Create hunting rule
Status:
Suspicious
First seen:
2023-03-19 08:39:27 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
19 of 37 (51.35%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cmktvyb7b7cmoyvctj3iidfv76ej4ulxnpma46lqyyada3qzghvq._file
Verdict:
malicious
Similar samples:
033deaaa0a55c91052dfe7abc3aaf77b5310d26437330e402a102d060ae0ace9
Rhadamanthys
1704307c4598fa8ec273bacaaaa2dfb24ac7e89dde8fd02a3e87b9f55fcdf9b6
Rhadamanthys
25605527f20f5d35b60f8e73fd14ddbcb376f8409606f692faf35d9c1c39c642
Rhadamanthys
3f8f13f0de6057e4ce3f86db22451d28d0ad9ee6cf852eb5ca24adbefe619c86
Rhadamanthys
462b121f72bc42fcefcfc67174e4de53083b977458c7ed3d4009eec6bddd3f1b
Rhadamanthys
47d56868d1577e5599d2f000c08875bb73492d055f73f4c7f5ca747d13b6410a
Rhadamanthys
69a2806df93b940b5994427a85d50f9eb2094a2ff2f7563ec3d2da2894b05d00
Rhadamanthys
b82271ccb8e0c8d3f8d0871c4931955ba547b9691afd41a5651beef80da56024
Rhadamanthys
bcb7f74cabff9b520fccd6afa1f8d6711fc004b4ad13c49849ee90978fc7873e
Rhadamanthys
f797a34828089feb29e7f77d31f184b335d7958755d385fad50d69fdbd3660d2
Rhadamanthys
+ 23 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:rhadamanthys evasion stealer
Link:
https://tria.ge/reports/230319-qyjfvsaf4w/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks for VirtualBox DLLs, possible anti-VM trick
Checks system information in the registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks BIOS information in registry
Checks computer location settings
Looks for VMWare Tools registry key
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Detect rhadamanthys stealer shellcode
Rhadamanthys
Unpacked files
SH256 hash:
f6b8ab17432d2a005fc6f3db56bd353395a585dfe73755bcc4380123e511b8d1
MD5 hash:
aef48ea70c5d1cd6586a18a06db29e87
SHA1 hash:
26ce0baf6275874322e6242e8a249af570d0df7b
Link:
https://www.unpac.me/results/e9e2b8d1-1b73-4742-b388-0359a0cf779d/
SH256 hash:
8e206f1f3d4a46efb609d57620bebce9389e357719204a6505bd05a5fd5ef0e4
MD5 hash:
7ba23d0975632ad29441cb67e4ddc1d8
SHA1 hash:
02d1730f804725b8f2cc7df5f3e4e8b63782ed72
Link:
https://www.unpac.me/results/e9e2b8d1-1b73-4742-b388-0359a0cf779d/
SH256 hash:
13153ae03f0fc4c762a29a76840cb5ff889e51776bd80e7970c600306e1931eb
MD5 hash:
085e4e146e6d59a89f8da11d37a8cb90
SHA1 hash:
10e44377d75550aa574f2b522c32ecd0a14df90a
Link:
https://www.unpac.me/results/e9e2b8d1-1b73-4742-b388-0359a0cf779d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/13153ae03f0fc4c762a29a76840cb5ff889e51776bd80e7970c600306e1931eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

Executable exe 13153ae03f0fc4c762a29a76840cb5ff889e51776bd80e7970c600306e1931eb

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/375652/
  
URLhaus
https://urlhaus.abuse.ch/url/2554569/

Comments