MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 653c12db63dc13521af00bac41d549d599d5705c81b8b8ee40988a4a0924eb22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	653c12db63dc13521af00bac41d549d599d5705c81b8b8ee40988a4a0924eb22
SHA3-384 hash:	1c61287587321f4ba1b8038e62aaae13899e0ec0d854b19832e3b36a167bdf2d34fa4857af38ed74795b165ef6b2c675
SHA1 hash:	42e1ea823f7e579d81a136b9deb010ca9541bdfb
MD5 hash:	ddf9984a27fa6a63ba3f584b05985d02
humanhash:	jupiter-finch-avocado-yankee
File name:	ddf9984a27fa6a63ba3f584b05985d02.exe
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	415'232 bytes
First seen:	2023-05-09 06:54:15 UTC
Last seen:	2023-05-13 22:49:20 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e0f7442c9aae17dbc3af11473e831c4e (5 x Rhadamanthys, 2 x Stop, 1 x Smoke Loader)
ssdeep	6144:dWYgvcFmrATHQmgR1W6WrEH6+YheLzsPKqtEa:3gvsm+HRZ6WQHtYhWzsiLa
Threatray	337 similar samples on MalwareBazaar
TLSH	T134947DD36EE17C61E6264A72CE2EE6F8761FF9908F1537EB2218EA1F0470162C572711
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	000040c0c0200100 (1 x Rhadamanthys)
Reporter	abuse_ch
Tags:	exe Rhadamanthys

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

258

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

ddf9984a27fa6a63ba3f584b05985d02.exe

Verdict:

Malicious activity

Analysis date:

2023-05-09 06:55:48 UTC

Tags:

rhadamanthys

Link:

https://app.any.run/tasks/e52537f1-1976-4453-afd6-09fb3a2ee9e3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Rhadamanthys

Detection:

Rhadamanthys

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/387698/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.16068.6516.UNOFFICIAL

Alert

Create hunting rule

Win.Packed.Trojanx-10001393-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

greyware mokes packed

Link:

https://www.filescan.io/uploads/6459ee4a3b40ceeb9637b522/reports/f171085f-b7db-4e1d-b86f-f7b2aa39dd8e/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/653c12db63dc13521af00bac41d549d599d5705c81b8b8ee40988a4a0924eb22

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Generic Malware

Malware family:

Generic Malware

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1ea472a7-3120-4beb-98a1-5ca811dde6d1

Joe Sandbox RHADAMANTHYS

Result

Threat name:

RHADAMANTHYS

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1228922

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/653c12db63dc13521af00bac41d549d599d5705c81b8b8ee40988a4a0924eb22/

ReversingLabs TitaniumCloud Win32.Spyware.Rhadamanthys

Threat name:

Win32.Spyware.Rhadamanthys

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-09 06:27:33 UTC

File Type:

PE (Exe)

Extracted files:

75

AV detection:

27 of 36 (75.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mu6bfw3d3qjvegxqbowedvkj2wm5k4c4qg4lr3satcfeucje5mra._file

Threatray malicious

Verdict:

malicious

Similar samples:

2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2

Rhadamanthys

3afa8aa568f26c6dcc9e6b32f376def4d0f54912ca431490e3b6558044fb2368

Rhadamanthys

4532489becbdf07bc0a932486ab95b497113f5600c7646b635eaea9bcfa430cd

Rhadamanthys

543c264b4e3db65f803e6a0fa4c71ac957fcb64a802e2a29dda024b58d0e7aaf

Rhadamanthys

597a4ade5d862166430037813118d0e94d993d87490fed195c0ade3fb6ab3e42

Rhadamanthys

b562b18a6df7d02dae4a37840084958370bb9a8cd821b7f85d2fd3e0caa662bf

Rhadamanthys

c58f48f203d4c0458672355b29caf31ad7ed5456cda3211eea2606452cf17a8f

Rhadamanthys

c7e1d534ed1a723b3aaecf3a257cf2f1bea5b46fb91b8510d9ae9523a3caf457

Rhadamanthys

cbe0c63e75f5586741a62e04f41339bc0d96f17b165e7d7ff6b8b635cb9a5e8a

Rhadamanthys

ccad7b6f65bf0381e93cabfceeb6e0bc5f838a37112981733b7f719f8d90087e

Rhadamanthys

+ 327 additional samples on MalwareBazaar

Hatching Triage rhadamanthys

Result

Malware family:

rhadamanthys

Alert

Create hunting rule

Score:

  10/10

Tags:

family:rhadamanthys stealer

Link:

https://tria.ge/reports/230509-hptapsge8t/

Behaviour

Detect rhadamanthys stealer shellcode

Rhadamanthys

Malware Config

C2 Extraction:

http://179.43.142.201/img/favicon.png

UnpacMe 2

Unpacked files

SH256 hash:

1797d67afc3879e8f47e41f157a56268a4a615f3e9b1e40c0b187a7915ee4107

MD5 hash:

9f086efa5c76a33e52fd2c925de924d3

SHA1 hash:

959399bcdd9e81bdb546f9559514dfad357f1361

Link:

https://www.unpac.me/results/70f1890e-6f68-4f6e-b4b3-865c90886cc7/

SH256 hash:

653c12db63dc13521af00bac41d549d599d5705c81b8b8ee40988a4a0924eb22

MD5 hash:

ddf9984a27fa6a63ba3f584b05985d02

SHA1 hash:

42e1ea823f7e579d81a136b9deb010ca9541bdfb

Link:

https://www.unpac.me/results/70f1890e-6f68-4f6e-b4b3-865c90886cc7/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

exe 653c12db63dc13521af00bac41d549d599d5705c81b8b8ee40988a4a0924eb22

(this sample)

Cape

https://www.capesandbox.com/analysis/387698/

  

URLhaus

https://urlhaus.abuse.ch/url/2525167/

  

Delivery method

Distributed via web download

  

URLhaus

https://urlhaus.abuse.ch/url/2519959/