MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a032ce9dfb9bb82989ea0eb406deeae00778e3aef234b67a64ee713c7e7dba9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a032ce9dfb9bb82989ea0eb406deeae00778e3aef234b67a64ee713c7e7dba9
SHA3-384 hash: db9e27f1d46dfea516223ff4398a76734fa00306cd4d47474b373e56d80d1510fdb64b02aff03b321bdac4dc10f16922
SHA1 hash: 38e2ec3f6a2abe8481294d1e06f7de50f8cab195
MD5 hash: 9d22b64d110d1e6711562b61abb42934
humanhash: stairway-cardinal-cat-foxtrot
File name:file
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:366'080 bytes
First seen:2023-03-17 13:45:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 800c211657980cdb5c72386d0a0450fd (5 x RedLineStealer, 3 x LaplasClipper, 3 x Smoke Loader)
ssdeep 6144:cJSLfGFu9AramzSsDiUOwxw+stB8b+Blj22Q/U:cJSKFCyOsfZalB8bYar
Threatray 278 similar samples on MalwareBazaar
TLSH T193746C43DEE53C44EA258B73AE1FC6E8761DB660DF4977B62218DE1F44B0272C163622
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
16.0% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 08a08090d0e08000 (1 x Rhadamanthys)
Reporter jstrosch
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
1
# of downloads :
223
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-03-17 13:51:03 UTC
Tags:
rhadamanthys
Link:
https://app.any.run/tasks/31b323bc-25e1-4ba4-b71e-9a297a441682

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Rhadamanthys
Create hunting rule
Link:
https://www.capesandbox.com/analysis/375117/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Detecting VM
Launching a process
Launching the default Windows debugger (dwwin.exe)
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/73592/overview
Behaviour
MalwareBazaar
MeasuringTime
CPUID_Instruction
SystemUptime
CheckCmdLine
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/64146ee8c65d1ebf04c1064a/reports/8c8f4be0-a57a-456f-a44d-1d877fa4989a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/4a032ce9dfb9bb82989ea0eb406deeae00778e3aef234b67a64ee713c7e7dba9
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e0799ffa-5417-4066-9a08-97d8b9b2d155
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1195901
Signature
Checks if the current machine is a virtual machine (disk enumeration)
Creates processes via WMI
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Early bird code injection technique detected
Found many strings related to Crypto-Wallets (likely being stolen)
Found potential ransomware demand text
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected AntiVM3
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 828813 Sample: file.exe Startdate: 17/03/2023 Architecture: WINDOWS Score: 100 27 Snort IDS alert for network traffic 2->27 29 Malicious sample detected (through community Yara rule) 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 6 other signatures 2->33 7 file.exe 2->7         started        10 WmiPrvSE.exe 2->10         started        process3 signatures4 35 Detected unpacking (changes PE section rights) 7->35 37 Detected unpacking (overwrites its own PE header) 7->37 39 Query firmware table information (likely to detect VMs) 7->39 41 5 other signatures 7->41 12 dllhost.exe 2 7->12         started        16 8F42.tmp.exe 2 10->16         started        process5 file6 23 C:\Users\user\AppData\Local\...\8F42.tmp.exe, PE32 12->23 dropped 43 Early bird code injection technique detected 12->43 45 Tries to harvest and steal browser information (history, passwords, etc) 12->45 47 Maps a DLL or memory area into another process 12->47 57 2 other signatures 12->57 18 dllhost.exe 3 12->18         started        25 C:\Users\user\AppData\Roaming\...\ntlhost.exe, PE32 16->25 dropped 49 Multi AV Scanner detection for dropped file 16->49 51 Detected unpacking (changes PE section rights) 16->51 53 Detected unpacking (overwrites its own PE header) 16->53 55 Machine Learning detection for dropped file 16->55 signatures7 process8 file9 21 C:\Users\user\AppData\...\dllhost.exe.log, CSV 18->21 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a032ce9dfb9bb82989ea0eb406deeae00778e3aef234b67a64ee713c7e7dba9/
Threat name:
Win32.Spyware.Rhadamanthys
Create hunting rule
Status:
Malicious
First seen:
2023-03-17 13:45:11 UTC
File Type:
PE (Exe)
Extracted files:
62
AV detection:
20 of 24 (83.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jibsz2o7xg5yfge6udvua3povyahpdr254ruwz5gj3trhr7h3ouq._file
Verdict:
malicious
Similar samples:
07c7643d1f63c0306b87574fab09731861f60d3a2543c66d0e29a90b5584d124
Rhadamanthys
2473d2451cb6e066df31a2457c700cd9e0b1585db96716c981b3f34deffdfd26
Rhadamanthys
2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2
Rhadamanthys
4532489becbdf07bc0a932486ab95b497113f5600c7646b635eaea9bcfa430cd
Rhadamanthys
6c89be96a021e75087a7f43cf5cd05293e1d3428c3a051f970cac9ce9895e555
Rhadamanthys
7208178bb02eab02073ace2c7a3a7be128e1eb168d8d710367e60f1abf3eac2c
Rhadamanthys
7a78888d3616fa77722ef3e59d343db0d32e43d62b79d911ae06c9a26707da21
Rhadamanthys
7e4dac07d2696331da92d33b3b8d888dbd60272845ebc7889ace9709d6cda45a
Rhadamanthys
a8b8116afae21d9c0edaf717611b611b78d0a097c303bfbe596ec4ead69897fe
Rhadamanthys
+ 268 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:rhadamanthys evasion stealer
Link:
https://tria.ge/reports/230317-q2ebbage45/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Checks for VirtualBox DLLs, possible anti-VM trick
Checks system information in the registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks BIOS information in registry
Looks for VMWare Tools registry key
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Detect rhadamanthys stealer shellcode
Rhadamanthys
Unpacked files
SH256 hash:
e99d3e54561f19a376974198d015fd3e8254c859837d336942c91170989b62cf
MD5 hash:
ce2eb837b855e18b8d3a32572b3a80b6
SHA1 hash:
8dbfcfd15bc002c2530a7b80e0102e017329de2c
Link:
https://www.unpac.me/results/3c4ee47b-ad4f-4363-911f-7989bf18fb3c/
SH256 hash:
4a032ce9dfb9bb82989ea0eb406deeae00778e3aef234b67a64ee713c7e7dba9
MD5 hash:
9d22b64d110d1e6711562b61abb42934
SHA1 hash:
38e2ec3f6a2abe8481294d1e06f7de50f8cab195
Link:
https://www.unpac.me/results/3c4ee47b-ad4f-4363-911f-7989bf18fb3c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4a032ce9dfb9bb82989ea0eb406deeae00778e3aef234b67a64ee713c7e7dba9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

Executable exe 4a032ce9dfb9bb82989ea0eb406deeae00778e3aef234b67a64ee713c7e7dba9

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/375117/
  
URLhaus
https://urlhaus.abuse.ch/url/2566098/
  
URLhaus
https://urlhaus.abuse.ch/url/2567063/

Comments