MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 320bf1b89342b15959fb29c944089d8d6e3c23108cdced1c912b0ea639000ba7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 320bf1b89342b15959fb29c944089d8d6e3c23108cdced1c912b0ea639000ba7
SHA3-384 hash: 97f8013f65dec1357bf434993ee20a8e9311d892c549153aef382900cee494963ab3fa274c018a11710107fa84ed9525
SHA1 hash: 88cf689dc6220a368dc5daaede70ea1fc5ffdb09
MD5 hash: af10d0f3f2fa79ba3051c2a96262b065
humanhash: floor-california-saturn-may
File name:recoverit_pr_setup.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:503'368 bytes
First seen:2023-02-06 16:00:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f28ad02a4adb6c9c9717704f5e5b34ac (8 x RedLineStealer, 6 x Smoke Loader, 3 x CoinMiner)
ssdeep 6144:eoOL6qi0cPHdUgJVwqbPQkHp8jdbAIcTA3S7j6gk5oTIs5TeUQr:eF2qi9WgJtPfHqRb9mYSn61+ISTfQr
Threatray 4'286 similar samples on MalwareBazaar
TLSH T1C9B4BE03E6F17CE3D91286729E0ECBE87ADDF5608E49676912188A1F14B01F1D7A772C
TrID 38.6% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
29.0% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon e0c8889eaeca7a9a (8 x RedLineStealer, 1 x CryptBot, 1 x Rhadamanthys)
Reporter Chainskilabs
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
1
# of downloads :
213
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
recoverit_pr_setup.exe
Verdict:
Malicious activity
Analysis date:
2023-02-06 16:03:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a184837e-e689-4100-a4fc-afcf2428a9b5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/360968/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Launching a process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/63e1243f1c9cbf7d625627a8/reports/b483fe50-6d08-4069-b253-dd226e0286f4/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/320bf1b89342b15959fb29c944089d8d6e3c23108cdced1c912b0ea639000ba7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b0f6d44a-45ed-41f8-ad37-337713a11776
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1166812
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Creates processes via WMI
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 799582 Sample: recoverit_pr_setup.exe Startdate: 06/02/2023 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Antivirus detection for URL or domain 2->52 54 6 other signatures 2->54 7 recoverit_pr_setup.exe 1 2->7         started        11 CD3D.tmp.exe 2 2->11         started        13 E450.tmp.exe 2->13         started        16 JTKvijqoGC.exe 1 2->16         started        process3 dnsIp4 38 C:\Users\user\AppData\...\vcredist_4350e9.dll, PE32+ 7->38 dropped 66 Detected unpacking (changes PE section rights) 7->66 68 Detected unpacking (overwrites its own PE header) 7->68 18 rundll32.exe 4 7->18         started        40 C:\Users\user\AppData\...\JTKvijqoGC.exe, PE32 11->40 dropped 70 Antivirus detection for dropped file 11->70 72 Multi AV Scanner detection for dropped file 11->72 74 Machine Learning detection for dropped file 11->74 22 cmd.exe 1 11->22         started        42 youtube-ui.l.google.com 142.250.184.110, 443, 49725 GOOGLEUS United States 13->42 44 www.youtube.com 13->44 76 Tries to harvest and steal browser information (history, passwords, etc) 13->76 24 cmd.exe 1 13->24         started        46 45.159.189.105, 49729, 80 HOSTING-SOLUTIONSUS Netherlands 16->46 file5 signatures6 process7 file8 34 C:\Users\user\AppData\Local\...450.tmp.exe, PE32+ 18->34 dropped 36 C:\Users\user\AppData\Local\...\CD3D.tmp.exe, PE32 18->36 dropped 56 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->56 58 Tries to steal Mail credentials (via file / registry access) 18->58 60 Tries to harvest and steal browser information (history, passwords, etc) 18->60 64 2 other signatures 18->64 62 Uses schtasks.exe or at.exe to add and modify task schedules 22->62 26 conhost.exe 22->26         started        28 schtasks.exe 1 22->28         started        30 conhost.exe 24->30         started        32 choice.exe 1 24->32         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/320bf1b89342b15959fb29c944089d8d6e3c23108cdced1c912b0ea639000ba7/
Threat name:
Win32.Trojan.MintZard
Create hunting rule
Status:
Malicious
First seen:
2023-02-06 16:01:08 UTC
File Type:
PE (Exe)
Extracted files:
82
AV detection:
18 of 39 (46.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gif7doetikyvswp3fheuice5rvxdyiyqrtoo2herfmhkmoiabotq._file
Verdict:
malicious
Similar samples:
129e4bbbb2295d04fc9e580698fc3fdfcb0de73269ec940d217260b7c44455f2
Rhadamanthys
140f170d8b83611cb8897164be174495dc51961dc34fbccc9a714917cc341b8f
Rhadamanthys
1d80b8ed824382630f9b336695f0c03670894b9a107951c74ccc5f287a3e37c6
Rhadamanthys
49a4c9b865e272372dc2c42f4e23861637616f84ee08b007786e3baef4af936f
Rhadamanthys
5fc3376cb40e9e8f22785c7b90e9e2c00acff1521f65691b33d9dc07195d0e8c
Rhadamanthys
8a8bf4a261ae984007e0da758f9c8c9c609beb83041e91d036ff4ef0ed1bb328
Rhadamanthys
+ 4'276 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:laplas family:rhadamanthys clipper collection discovery spyware stealer
Link:
https://tria.ge/reports/230206-tf7mhseg35/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
GoLang User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Accesses Microsoft Outlook profiles
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Detect rhadamanthys stealer shellcode
Laplas Clipper
Rhadamanthys
Malware Config
C2 Extraction:
45.159.189.105
Unpacked files
SH256 hash:
0f6bdbaabfca43e24b6c9dd091db56d97d8e32645e56748fd21bb570cd66627b
MD5 hash:
2d69fb9e5882b67b33b5847144ad9f87
SHA1 hash:
fdbc9bfcd150033b459dcf056a8ea7e36fa5c549
Link:
https://www.unpac.me/results/9e3eb9b1-e0bf-4397-8f31-377b0e12411e/
SH256 hash:
320bf1b89342b15959fb29c944089d8d6e3c23108cdced1c912b0ea639000ba7
MD5 hash:
af10d0f3f2fa79ba3051c2a96262b065
SHA1 hash:
88cf689dc6220a368dc5daaede70ea1fc5ffdb09
Link:
https://www.unpac.me/results/9e3eb9b1-e0bf-4397-8f31-377b0e12411e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/320bf1b89342/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/320bf1b89342b15959fb29c944089d8d6e3c23108cdced1c912b0ea639000ba7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/360968/

Comments