MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 479dbe11c5211b7cf1c1e4ad4e66ed22ac6fe4750fb31892b32d9f05c42d40ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	479dbe11c5211b7cf1c1e4ad4e66ed22ac6fe4750fb31892b32d9f05c42d40ef
SHA3-384 hash:	8325ca2706fff44e9f6aee07f8a1de42ad824f17106573620b6106b8c35131b9ac4becb40364f21570c5ad4d5645387d
SHA1 hash:	74bf78b98f3637236b43f16e09b3449fbba1caec
MD5 hash:	f7891882225dc9d0e22b07deabf36f20
humanhash:	winner-north-indigo-fanta
File name:	file
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	492'032 bytes
First seen:	2023-12-21 16:42:38 UTC
Last seen:	2023-12-21 18:09:13 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	21a899cb2bf7f1bc566f7c47e1443114 (2 x LummaStealer, 2 x Stealc, 1 x Rhadamanthys)
ssdeep	6144:TYlaLw74mUyID3anV6eybwxWKbbYm0bCh92h1nEGhlCWGjgEWJasFO+lrwcvNs:T9k74mJV6eykxfbbVECr2SjYZlDv
TLSH	T119A4BF5342F1BC54EA664B738E2EC6E8B61EB580DF4977A71218AA9F1C750F2C173312
TrID	46.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 25.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 8.5% (.EXE) Win64 Executable (generic) (10523/12/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	0808000818504000 (1 x Rhadamanthys)
Reporter	andretavare5
Tags:	exe Rhadamanthys

andretavare5

Sample downloaded from http://85.209.11.204/api/files/software/ww.exe

Intelligence

---

File Origin

# of uploads :

4

# of downloads :

299

Origin country :

US

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/468827/

ClamAV Detected

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/65846b18b855eb3693ebace7/reports/bdb47d0a-4f37-4a03-83b1-7360d667ffdd/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/479dbe11c5211b7cf1c1e4ad4e66ed22ac6fe4750fb31892b32d9f05c42d40ef

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer FlashDevelop

Malware family:

FlashDevelop

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/79e275ce-6f3f-4d35-a159-6815896883ae

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1365680

Signature

Antivirus / Scanner detection for submitted sample

Checks if the current machine is a virtual machine (disk enumeration)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/479dbe11c5211b7cf1c1e4ad4e66ed22ac6fe4750fb31892b32d9f05c42d40ef

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/479dbe11c5211b7cf1c1e4ad4e66ed22ac6fe4750fb31892b32d9f05c42d40ef/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-21 16:43:05 UTC

File Type:

PE (Exe)

Extracted files:

41

AV detection:

18 of 23 (78.26%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=i6o34eofeenxz4ob4swu4zxnekwg7zdvb6zrrevtfwpqlrbnidxq._file

Threatray malicious

Verdict:

malicious

Hatching Triage rhadamanthys

Result

Malware family:

rhadamanthys

Alert

Create hunting rule

Score:

  10/10

Tags:

family:rhadamanthys stealer

Link:

https://tria.ge/reports/231221-t78nwsbbdq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

UnpacMe 2

Unpacked files

SH256 hash:

9b3a94ed909ca483331a91cfc72dfd4ca9107b6cf09f3cd3a9c6c6987275b057

MD5 hash:

11f30f5d4ab55f2d1765a0ad20d2950c

SHA1 hash:

69860197792990d197319704980180c71dead8b1

Link:

https://www.unpac.me/results/4224fcc3-d404-4cf1-881e-3ebeec9bb5a7/

SH256 hash:

479dbe11c5211b7cf1c1e4ad4e66ed22ac6fe4750fb31892b32d9f05c42d40ef

MD5 hash:

f7891882225dc9d0e22b07deabf36f20

SHA1 hash:

74bf78b98f3637236b43f16e09b3449fbba1caec

Link:

https://www.unpac.me/results/4224fcc3-d404-4cf1-881e-3ebeec9bb5a7/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/479dbe11c521/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/479dbe11c5211b7cf1c1e4ad4e66ed22ac6fe4750fb31892b32d9f05c42d40ef

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Dropped by

PrivateLoader

  

Delivery method

Distributed via drive-by

  

URLhaus

https://urlhaus.abuse.ch/url/2743108/

Cape

https://www.capesandbox.com/analysis/468827/