🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4dcf5515a7cbd5840a89fe3b8d12e14062b36b178d93596ccf7ddebb6933044e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4dcf5515a7cbd5840a89fe3b8d12e14062b36b178d93596ccf7ddebb6933044e
SHA3-384 hash: 7acf979d5018be011f1490c71da61e8eede86092d17872d7afe82050c792d6633fe32ec666d975719277003b8ba5fa63
SHA1 hash: 731f48aff320e09bd187d0d2379cdebfb4d67daf
MD5 hash: 171923fa2aebde8ba27690d6e40feaf8
humanhash: zulu-leopard-massachusetts-sink
File name:cleanhelper.dll
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:542'720 bytes
First seen:2023-12-06 19:35:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fa74abf695550ad17e5c7124391838ec (1 x Rhadamanthys)
ssdeep 12288:TONWbhE5i3VNAAlOYtsSYflTgR6zYoSI:inA3uSYf1gR6YO
Threatray 3 similar samples on MalwareBazaar
TLSH T1B4B47C19A3A843F4E1BBE174C887460BE7B1B8562171964F43F14BAB1F2B7715A2F321
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter Anonymous
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
1
# of downloads :
348
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/463004/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Gathering data
Verdict:
No Threat
Threat level:
  2.5/10
Confidence:
100%
Tags:
anti-vm control crypto greyware lolbin masquerade shell32
Link:
https://www.filescan.io/uploads/6570cd263636548f373ea538/reports/15e4a521-0623-463d-9ee2-f517754b151b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/4dcf5515a7cbd5840a89fe3b8d12e14062b36b178d93596ccf7ddebb6933044e
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/becb1cb6-e1c3-4862-9611-63581291500c
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1354910
Signature
Antivirus detection for dropped file
Checks if the current machine is a virtual machine (disk enumeration)
Contain functionality to detect virtual machines
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking mutex)
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1354910 Sample: cleanhelper.dll.exe Startdate: 06/12/2023 Architecture: WINDOWS Score: 96 39 myspace-cdn.tech 2->39 41 fast-cdn.space 2->41 43 allodsmail.com 2->43 53 Snort IDS alert for network traffic 2->53 55 Antivirus detection for dropped file 2->55 57 Multi AV Scanner detection for dropped file 2->57 59 Machine Learning detection for dropped file 2->59 9 loaddll64.exe 1 2->9         started        signatures3 process4 process5 11 cmd.exe 1 9->11         started        13 rundll32.exe 1 9->13         started        15 rundll32.exe 9->15         started        18 5 other processes 9->18 signatures6 20 rundll32.exe 1 11->20         started        24 dialer.exe 13->24         started        27 WerFault.exe 2 13->27         started        67 Found API chain indicative of debugger detection 15->67 69 Contain functionality to detect virtual machines 15->69 29 WerFault.exe 23 16 15->29         started        71 System process connects to network (likely due to code injection or exploit) 18->71 process7 dnsIp8 45 allodsmail.com 37.221.65.146, 49705, 49706, 49707 FIRSTDC-ASRU Russian Federation 20->45 37 C:\Users\user\AppData\Local\...\xkvtewrj.dll, PE32+ 20->37 dropped 31 rundll32.exe 20->31         started        35 WerFault.exe 16 20->35         started        61 Found evasive API chain (may stop execution after checking mutex) 24->61 63 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 24->63 65 Checks if the current machine is a virtual machine (disk enumeration) 24->65 file9 signatures10 process11 dnsIp12 47 myspace-cdn.tech 194.87.218.3, 4351 AS-REGRU Russian Federation 31->47 49 192.168.1.28, 4351 unknown unknown 31->49 51 System process connects to network (likely due to code injection or exploit) 31->51 signatures13
Score:
85%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4dcf5515a7cbd5840a89fe3b8d12e14062b36b178d93596ccf7ddebb6933044e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4dcf5515a7cbd5840a89fe3b8d12e14062b36b178d93596ccf7ddebb6933044e/
Threat name:
Win64.Spyware.Rhadamanthys
Create hunting rule
Status:
Malicious
First seen:
2023-12-06 19:36:06 UTC
File Type:
PE+ (Dll)
AV detection:
7 of 23 (30.43%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jxhvkfnhzpkyicuj7y5y2exbibrlg2yxrwjvs3gppxplw2jtarha._file
Verdict:
unknown
Similar samples:
12e4124bf790bced8b0cff6506511bc15e8b65fd31fc2f13697ce899f6ad9b69
Rhadamanthys
4dcf5515a7cbd5840a89fe3b8d12e14062b36b178d93596ccf7ddebb6933044e
Rhadamanthys
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:rhadamanthys stealer
Link:
https://tria.ge/reports/231206-yb12dshb3v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Blocklisted process makes network request
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
4dcf5515a7cbd5840a89fe3b8d12e14062b36b178d93596ccf7ddebb6933044e
MD5 hash:
171923fa2aebde8ba27690d6e40feaf8
SHA1 hash:
731f48aff320e09bd187d0d2379cdebfb4d67daf
Link:
https://www.unpac.me/results/d39c51d5-c355-400d-a7be-5e1eeb558e6f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4dcf5515a7cbd5840a89fe3b8d12e14062b36b178d93596ccf7ddebb6933044e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/463004/

Comments