MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 14

Intelligence 14 IOCs YARA 6 File information Comments

SHA256 hash:	57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4
SHA3-384 hash:	546d747014e3b32e24fbbc1aae0ac98977eb412ca028532b7987c82bec055689dda30bb86c50026a490c0bd2f3eeef3c
SHA1 hash:	04b2137cf45cf32ad141c52ac66f67687bc7f35c
MD5 hash:	c5c64755f463c91c92f516b3214c5b37
humanhash:	don-virginia-uniform-king
File name:	SecuriteInfo.com.Trojan.Packed2.45463.31130.14404
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	466'944 bytes
First seen:	2023-09-22 16:35:48 UTC
Last seen:	2023-10-01 08:56:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	eca0c30b65294d02a6c6180a6b323b58 (10 x Rhadamanthys)
ssdeep	6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+g:2uWP/BZUyoLu8Agsmxwrvejkd2
Threatray	33 similar samples on MalwareBazaar
TLSH	T1C2A45D56AFC33EC0DF89A6B24800FBAE176E4275CA42D0C4BD6CE5525B275A7D70B234
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	SecuriteInfoCom
Tags:	77-91-68-78 exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

277

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

rh_0.4.9rc1.exe

Verdict:

Malicious activity

Analysis date:

2023-09-22 16:31:34 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c5d32149-1883-4e6e-a3bc-aa783e4f8421

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Rhadamanthys

Link:

https://www.capesandbox.com/analysis/450665/

Detection(s):

SecuriteInfo.com.Trojan.Packed2.45463.31130.14404.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Launching a process

Unauthorized injection to a system process

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware zusy

Link:

https://www.filescan.io/uploads/650dc279988a26b6d96fd7f4/reports/dd620f0a-7461-4c1f-a401-ca8241e31d53/overview

Verdict:

Malicious

Labled as:

Trojan.Mansabo

Link:

https://www.hybrid-analysis.com/sample/57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/572b0c3b-6d16-459b-bc88-7f5bc9c8e6f5

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1313040

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4/

Threat name:

Win32.Spyware.Rhadamanthys

Status:

Malicious

First seen:

2023-09-19 20:58:09 UTC

File Type:

PE (Exe)

AV detection:

28 of 38 (73.68%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k6jzdf523cfr6jsvlatkdxrxwvjhja5fla3ultlbjl7tjhfud2sa._file

Verdict:

malicious

Rhadamanthys

6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb

Rhadamanthys

7de67b4ae3475e1243c80ba446a8502ce25fec327288d81a28be69706b4d9d81

Rhadamanthys

8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f

Rhadamanthys

a6d0e60e46974bcc2b95d79efe42aef131019e1a1db2f71a780c51a68cc36199

Rhadamanthys

ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6

Rhadamanthys

b45536b641815e8e230c3519ee7b9dcb4bf186ed2f4dc73b4be00066550731aa

Rhadamanthys

fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b

Rhadamanthys

+ 23 additional samples on MalwareBazaar

Result

Malware family:

rhadamanthys

Score:

10/10

Tags:

family:rhadamanthys stealer

Link:

https://tria.ge/reports/230922-t38s4abb97/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Detect rhadamanthys stealer shellcode

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Unpacked files

SH256 hash:

57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4

MD5 hash:

c5c64755f463c91c92f516b3214c5b37

SHA1 hash:

04b2137cf45cf32ad141c52ac66f67687bc7f35c

Detections:

RhadamanthysLoader

win_brute_ratel_c4_w0

Link:

https://www.unpac.me/results/79f4849d-b776-41ca-b9f7-513ff76bc3b5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/57939197bad88b1f26555826a1de37b5527483a5583745cd614aff349cb41ea4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BruteSyscallHashes Create hunting rule
Author:	Embee_Research @ Huntress

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	win_bruteratel_syscall_hashes_oct_2022 Create hunting rule
Author:	Embee_Research @ Huntress
Description:	Detection of Brute Ratel Badger via api hashes of Nt* functions.

Rule name:	win_brute_ratel_c4_w0 Create hunting rule
Author:	Embee_Research @ Huntress

Rule name:	win_Brute_Syscall_Hashes Create hunting rule
Author:	Embee_Research @ Huntress
Description:	Detection of Brute Ratel Badger via api hashes of Nt* functions.