MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5578a78576a35a6a95c8a5372e7d498fd4d2a4d5d7abe7369a14307d578192c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5578a78576a35a6a95c8a5372e7d498fd4d2a4d5d7abe7369a14307d578192c6
SHA3-384 hash:	815a8038f6b742665f96cce6dc4bedda4ba6497efa5303d580eaeee42ef95f29b58d1695c57b4fd9b2d4fe36535317e2
SHA1 hash:	f9a9aaf15c2b09fff7d4681c5112b48711094056
MD5 hash:	64a3d4fa1b42fb0d291469bea507f9ed
humanhash:	vegan-harry-ten-failed
File name:	SecuriteInfo.com.Win32.Evo-gen.24852.20254
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	363'520 bytes
First seen:	2024-02-18 21:33:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	be49a2411263045f8ee0c442783b5f83 (6 x Rhadamanthys)
ssdeep	6144:g2qezd2ab1/RuHk+M3k8M3W7XomjOJCqshrOlumY6DMIewgxQfq8sb:gf2R/EEkCQFYDwRqH
TLSH	T1BB7423CFB69A5418DD3626F3DE5652383B1574580B460EFF9D6B6E20B010FA95D28F03
TrID	40.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 16.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 12.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.0% (.EXE) Win32 Executable (generic) (4504/4/1) 5.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	SecuriteInfoCom
Tags:	exe Rhadamanthys

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

309

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/476665/

ClamAV Detected

Detection(s):

Porcupine.Malware.58887.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Win32.Evo-gen.24852.20254.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Launching a process

Using the Windows Management Instrumentation requests

Connection attempt

Sending a custom TCP request

Reading critical registry keys

Searching for the window

Unauthorized injection to a recently created process

Creating a window

Unauthorized injection to a system process

Stealing user critical data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/65d277cbc5e1a083fbf0ebe9/reports/24019a67-0e9e-44d7-8519-f7891d6b61eb/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/5578a78576a35a6a95c8a5372e7d498fd4d2a4d5d7abe7369a14307d578192c6

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bc761b9c-92f6-46d5-a7ac-e609241d5425

Joe Sandbox RHADAMANTHYS

Result

Threat name:

RHADAMANTHYS

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1394152

Signature

.NET source code contains potential unpacker

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Writes to foreign memory regions

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

91%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/5578a78576a35a6a95c8a5372e7d498fd4d2a4d5d7abe7369a14307d578192c6

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5578a78576a35a6a95c8a5372e7d498fd4d2a4d5d7abe7369a14307d578192c6/

ReversingLabs TitaniumCloud Win32.Trojan.Rhadamanthys

Threat name:

Win32.Trojan.Rhadamanthys

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-02-18 09:11:30 UTC

File Type:

PE (Exe)

AV detection:

16 of 24 (66.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kv4kpblwunngvfoiuu3s47kjr7knfjgv26v6onu2cqyh2v4bslda._file

Threatray malicious

Verdict:

malicious

Hatching Triage rhadamanthys

Result

Malware family:

rhadamanthys

Alert

Create hunting rule

Score:

  10/10

Tags:

family:rhadamanthys stealer

Link:

https://tria.ge/reports/240218-1eq2psfc58/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

UnpacMe

Unpacked files

SH256 hash:

5578a78576a35a6a95c8a5372e7d498fd4d2a4d5d7abe7369a14307d578192c6

MD5 hash:

64a3d4fa1b42fb0d291469bea507f9ed

SHA1 hash:

f9a9aaf15c2b09fff7d4681c5112b48711094056

Link:

https://www.unpac.me/results/d8c38ac5-6a11-491f-9f04-b976743c708e/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5578a78576a3/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5578a78576a35a6a95c8a5372e7d498fd4d2a4d5d7abe7369a14307d578192c6

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/476665/