MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 614649c585382f0f01dda0c2fa100c21ce9509170c10f0a582af3babd8fd99d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	614649c585382f0f01dda0c2fa100c21ce9509170c10f0a582af3babd8fd99d1
SHA3-384 hash:	afbfb013b0fce8e923ad84f35525cbd279016d5eeae553914ae88aaad3362d1c02e0397bfb261e35eb6385bcc83d80d0
SHA1 hash:	f44133fedbafd0b2eac4ca789ed7c92f53dde6d4
MD5 hash:	07c926e5f7f9929fa2014bb7c565683f
humanhash:	early-lima-aspen-spaghetti
File name:	SecuriteInfo.com.Variant.Zusy.470978.10523.14954
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	468'992 bytes
First seen:	2023-06-02 12:30:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8de2fe168308519536adb42b2323eb66 (3 x Rhadamanthys, 1 x Smoke Loader, 1 x GCleaner)
ssdeep	6144:pfQzc/+BETU2edkedEHBLlMWaOr5+BZX6U4o4OKVMEiAd+bpwr4EKOs+rOyRj:pozc/+Bnil3/tK8diAdOpu4Is+rXR
Threatray	38 similar samples on MalwareBazaar
TLSH	T1B0A4BF0362D16C6CF62686724F2FC2F8661EF6609F5937AB32149A2F05711B2C672FD1
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	00426a6080800800 (1 x Rhadamanthys)
Reporter	SecuriteInfoCom
Tags:	exe Rhadamanthys

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

261

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

SecuriteInfo.com.Variant.Zusy.470978.10523.14954

Verdict:

No threats detected

Analysis date:

2023-06-02 12:33:24 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c5f9edd9-77bc-4a07-9174-5702870b6c66

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Rhadamanthys

Detection:

Rhadamanthys

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/394786/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Variant.Zusy.470978.10523.14954.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/89053/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6479e1079ce2e6bd7ed087ef/reports/fa1fa91d-e7d0-413d-b3c4-4d981b34966a/overview

Hybrid Analysis Zusy.Generic

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/614649c585382f0f01dda0c2fa100c21ce9509170c10f0a582af3babd8fd99d1

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/157f87ea-ba38-4648-927b-20573cdba9ee

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1247565

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/614649c585382f0f01dda0c2fa100c21ce9509170c10f0a582af3babd8fd99d1/

ReversingLabs TitaniumCloud Win32.Spyware.Rhadamanthys

Threat name:

Win32.Spyware.Rhadamanthys

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-02 12:31:05 UTC

File Type:

PE (Exe)

Extracted files:

42

AV detection:

18 of 24 (75.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mfdetrmfhaxq6ao5udbpueamehhjkcixbqipbjmcv452xwh5thiq._file

Threatray malicious

Verdict:

malicious

Similar samples:

2aaae232c889912fe61abafb3dd36bfa3499d21daaf61d8c839ed53c50ffa388

Rhadamanthys

380c81695a2340dbaf8d0427188536d1eddfca4ee41a5aa7d23eb8a91d617c4c

Rhadamanthys

4a524e63c81e6cf9ab8a86f8de0973ea6a6d0973545867d34eba1b777e238628

Rhadamanthys

4b1a1ad26d581f4670cc0521f6c7fb4ef0370003b149d06f5f40ed637bbd16e4

Rhadamanthys

5f79066ea8731982dcd1d2f5cba63213ec60f5bed4937fc5992bf8b11cd53e96

Rhadamanthys

8d39941ae1a443b26ba2015e41ffc11346881cfe16056fec5c45814638ee64f4

Rhadamanthys

a19db6939acfd18c5b6db81339722a8cb0f4130f5d95dab84fb9b485ce56a48c

Rhadamanthys

a2a99c9f239e20040a7f5b6a1c215263f331862f9924bbafe2dadc73b16bee3e

Rhadamanthys

e2160fb0cdb707aa84430207c6357cb9bc099ab4cbbc5299d8be7208a41a718b

Rhadamanthys

ea6d07dfe0184b08a53161805d66a1bc1f7974367b8407968e1922d41366c236

Rhadamanthys

+ 28 additional samples on MalwareBazaar

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/230602-pp2emsbg2x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Program crash

UnpacMe win_brute_ratel_c4_w0

Unpacked files

SH256 hash:

1d368217fb22e55b73dcaf33fdc78212bdfbd26dcd7500dbe8507781abeb36d3

MD5 hash:

0bfb1f9b6681e566b5ea98d3d47082e3

SHA1 hash:

4d92d6918efdbc624482aab18426db7f9565c8a1

Detections:

win_brute_ratel_c4_w0

Alert

Create hunting rule

Link:

https://www.unpac.me/results/562676f9-5b14-4f2e-94c6-11894ac60c7c/

Parent samples :

31b6d0d457e33dc326b8d488099a03d277928b70c09686965034cc62ff3e9b55
de270b73b701efa4cac18891088e795f37a9f7f9663ecbb43e0b8e358be65b51
5a21ccce86cd6e31b3860f76aa4106ea6c60df652fd44ea22fe668e89b460163
614649c585382f0f01dda0c2fa100c21ce9509170c10f0a582af3babd8fd99d1

SH256 hash:

614649c585382f0f01dda0c2fa100c21ce9509170c10f0a582af3babd8fd99d1

MD5 hash:

07c926e5f7f9929fa2014bb7c565683f

SHA1 hash:

f44133fedbafd0b2eac4ca789ed7c92f53dde6d4

Link:

https://www.unpac.me/results/562676f9-5b14-4f2e-94c6-11894ac60c7c/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/614649c585382f0f01dda0c2fa100c21ce9509170c10f0a582af3babd8fd99d1

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

exe 614649c585382f0f01dda0c2fa100c21ce9509170c10f0a582af3babd8fd99d1

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2649818/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/394786/