MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5931fac14fecb22cacb5cd495e2b49ead9bd6354ca9678257a5bc7929395db98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments

SHA256 hash:	5931fac14fecb22cacb5cd495e2b49ead9bd6354ca9678257a5bc7929395db98
SHA3-384 hash:	b29e216eaee7b0a126dc9caa0e464b5e53f7fdc23d31b870875e190607ab338e8bcd2589d92db696f802ed1f53031b4a
SHA1 hash:	6aebc644cb0e6b69da544bb71d75db25a25bc49a
MD5 hash:	a4aed7853d05c6eaa0c15223d2ee6a7d
humanhash:	jupiter-football-gee-delaware
File name:	a4aed7853d05c6eaa0c15223d2ee6a7d.exe
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	263'680 bytes
First seen:	2023-02-22 11:19:51 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	61084082e3ba31c8feb1b1c41020622a (4 x RedLineStealer, 2 x Smoke Loader, 1 x Rhadamanthys)
ssdeep	6144:T30L8gAsu+mlkpRV6UyjFg5L1a0sZq01Z:L048ukpREBg5LbsJT
Threatray	203 similar samples on MalwareBazaar
TLSH	T18B44E12079A2C071C457857C4835EAAD6EBEB5601776D88B3B78167EDF302E35BB2306
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	411edec2868c9a88 (1 x Rhadamanthys)
Reporter	abuse_ch
Tags:	exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

235

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

a4aed7853d05c6eaa0c15223d2ee6a7d.exe

Verdict:

Malicious activity

Analysis date:

2023-02-22 11:25:40 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f2942b6c-4447-499b-99a7-80bb534b81d3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/369014/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP GET request

Creating a file in the %AppData% directory

Launching a process

Deleting a recently created file

Launching the default Windows debugger (dwwin.exe)

Reading critical registry keys

Searching for the window

Forced system process termination

Stealing user critical data

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/72226/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

CPUID_Instruction

EvasionQueryPerformanceCounter

CheckCmdLine

EvasionGetTickCount

Verdict:

Suspicious

Threat level:

5/10

Confidence:

75%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/63f5fa682fa3ab63401f5e46/reports/900b6937-8e16-435b-a3f9-576d33f37ea7/overview

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/5931fac14fecb22cacb5cd495e2b49ead9bd6354ca9678257a5bc7929395db98

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Cobalt Strike

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/571bcb22-6d05-45b0-b920-44623947eeb1

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1180490

Signature

Contain functionality to detect virtual machines

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to hide a thread from the debugger

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found potential ransomware demand text

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Searches for specific processes (likely to inject)

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5931fac14fecb22cacb5cd495e2b49ead9bd6354ca9678257a5bc7929395db98/

Threat name:

Win32.Trojan.Krypter

Status:

Malicious

First seen:

2023-02-22 11:20:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 39 (46.15%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ley7vqkp5szczlfvzvev4k2j5lm32y2uzklhqjl2lpdzfe4v3oma._file

Verdict:

malicious

Rhadamanthys

5fc3376cb40e9e8f22785c7b90e9e2c00acff1521f65691b33d9dc07195d0e8c

Rhadamanthys

64d1d03c3378be695f30daea3877b732f662fc453dcd03af0f7990467c698a8f

Rhadamanthys

8a8bf4a261ae984007e0da758f9c8c9c609beb83041e91d036ff4ef0ed1bb328

Rhadamanthys

a860f0a0550d4e011d2fa244f01892f163d218f036c273e78851ab383d361843

Rhadamanthys

d85d8e7789de173ab6af6cddbd31fe5c024987627abfa8ae0f42f6e995d1f205

Rhadamanthys

f8c0451352782c2b6efd3fd5a6d6528ab4009b4b3c46e8064c6079be792667e4

Rhadamanthys

fd19241e3dbb2519f4f10b8e415e5dee056a7f2894bd7b0e7000a544147caf0a

Rhadamanthys

fd77a789e1cdaee10a146bb935c8a29515a009316f1dbb9e99789eede43e3189

Rhadamanthys

+ 193 additional samples on MalwareBazaar

Result

Malware family:

rhadamanthys

Score:

10/10

Tags:

family:rhadamanthys collection discovery spyware stealer

Link:

https://tria.ge/reports/230222-nffadabb34/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

Accesses Microsoft Outlook profiles

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Detect rhadamanthys stealer shellcode

Rhadamanthys

Unpacked files

SH256 hash:

9c0bd64e8888569d9f394853aade64392c431a684452d9bc8f819dfb2d1bac1a

MD5 hash:

016615af8b3cb0a90066b3bedcf65aa9

SHA1 hash:

315dd04a70f9bcc2b62b57846dbfa79426eb5856

Link:

https://www.unpac.me/results/35d195a5-49d9-442f-8664-6b4023189c05/

SH256 hash:

5931fac14fecb22cacb5cd495e2b49ead9bd6354ca9678257a5bc7929395db98

MD5 hash:

a4aed7853d05c6eaa0c15223d2ee6a7d

SHA1 hash:

6aebc644cb0e6b69da544bb71d75db25a25bc49a

Link:

https://www.unpac.me/results/35d195a5-49d9-442f-8664-6b4023189c05/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5931fac14fec/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5931fac14fecb22cacb5cd495e2b49ead9bd6354ca9678257a5bc7929395db98

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.