MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ef8e0030564b34c5dc795e3875137b95dcd08d2866797a0a0d18569e9078b26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 13

Intelligence 13 IOCs YARA 3 File information Comments

SHA256 hash:	5ef8e0030564b34c5dc795e3875137b95dcd08d2866797a0a0d18569e9078b26
SHA3-384 hash:	acb48db518ecb9c16dd97f2ee65223dd59d2bfb5354e7f860b5ce8f39768143b1b64f1becb38cab5c454cca13361feaa
SHA1 hash:	b426325917fa390a56593556f0c9d127a209bcca
MD5 hash:	c38c7a3bf7794e76ef04bc2d3fb7c8bb
humanhash:	tennessee-purple-nineteen-thirteen
File name:	setup.exe
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	263'680 bytes
First seen:	2023-04-03 12:06:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0ee9a5ef4366f789036d2435034645ed (4 x Stop, 2 x Rhadamanthys, 2 x DanaBot)
ssdeep	3072:hFVIAEHpE6QLiu1j8RmsHK01jHAHMUQhRBXC2VZO7FG5SlwVqM3vv3ms95vaz:hT0E6XCu71jHOpSNwwV7HmE
TLSH	T13D44E01077A1C872D91781315839F6E0B62AB8B297B1CACB77184B7F4D703C1AB7A359
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	002ca4d0686c3000 (1 x Rhadamanthys)
Reporter	Chainskilabs
Tags:	exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

207

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

setup.exe

Verdict:

Malicious activity

Analysis date:

2023-04-03 12:07:58 UTC

Tags:

rhadamanthys

Link:

https://app.any.run/tasks/04020382-a857-4120-8c6f-eacfadfbc874

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Rhadamanthys

Link:

https://www.capesandbox.com/analysis/379594/

Detection(s):

Sanesecurity.Malware.29066.BadIN.UNOFFICIAL

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Sending an HTTP GET request

Sending a custom TCP request

Launching a process

Launching the default Windows debugger (dwwin.exe)

Reading critical registry keys

Unauthorized injection to a system process

Stealing user critical data

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/76282/overview

Behaviour

MalwareBazaar

CPUID_Instruction

SystemUptime

MeasuringTime

EvasionQueryPerformanceCounter

CheckCmdLine

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed ransomx ursnif xpack

Link:

https://www.filescan.io/uploads/642ac169d1b7f0d264f9eee8/reports/6fe81823-c234-4646-81ec-5d54b08cee39/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/5ef8e0030564b34c5dc795e3875137b95dcd08d2866797a0a0d18569e9078b26

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/dab128f0-13eb-45b9-aa10-2ab2cd56d0c9

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1207012

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Found potential ransomware demand text

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5ef8e0030564b34c5dc795e3875137b95dcd08d2866797a0a0d18569e9078b26/

Threat name:

Win32.Spyware.Rhadamanthys

Status:

Malicious

First seen:

2023-04-03 12:07:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 23 (91.30%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=l34oaayfmszuyxohsxryoujxxfo42cgsqztzpifa2gcwt2ihrmta._file

Verdict:

malicious

Result

Malware family:

rhadamanthys

Score:

10/10

Tags:

family:rhadamanthys collection stealer

Link:

https://tria.ge/reports/230403-pabknsga9s/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

Accesses Microsoft Outlook profiles

Detect rhadamanthys stealer shellcode

Rhadamanthys

Unpacked files

SH256 hash:

1797d67afc3879e8f47e41f157a56268a4a615f3e9b1e40c0b187a7915ee4107

MD5 hash:

9f086efa5c76a33e52fd2c925de924d3

SHA1 hash:

959399bcdd9e81bdb546f9559514dfad357f1361

Link:

https://www.unpac.me/results/69d8fd05-e728-4dbb-b2d1-94cd1e5c97ee/

SH256 hash:

5ef8e0030564b34c5dc795e3875137b95dcd08d2866797a0a0d18569e9078b26

MD5 hash:

c38c7a3bf7794e76ef04bc2d3fb7c8bb

SHA1 hash:

b426325917fa390a56593556f0c9d127a209bcca

Link:

https://www.unpac.me/results/69d8fd05-e728-4dbb-b2d1-94cd1e5c97ee/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5ef8e0030564/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	Suspicious_Macro_Presence Create hunting rule
Author:	Mehmet Ali Kerimoglu (CYB3RMX)
Description:	This rule detects common malicious/suspicious implementations.