MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68cc07802289ffde1c9047856d1c15e94482d874c60f5e1fc470e8bc59b20f32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 10


Intelligence 10 IOCs YARA 10 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68cc07802289ffde1c9047856d1c15e94482d874c60f5e1fc470e8bc59b20f32
SHA3-384 hash: cb0d894df72a5ac5da34c45f7a92052d16636d01e00c8d8a4fc94af08fb6519f557a85e8b6a81446028e962bbd978c8b
SHA1 hash: 11944a076090d1b5b39ba6b52c3a8a9d9683f416
MD5 hash: 151b39cf4263b51c7e7997f709808891
humanhash: oven-seventeen-twelve-early
File name:vstdlib_s64.dll
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:5'885'440 bytes
First seen:2025-03-04 16:41:45 UTC
Last seen:2025-03-04 17:26:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fc624d2bfdc618ba2b7e188de6b5b47c (1 x Rhadamanthys)
ssdeep 49152:rqEFV7cQgpQubLRCreJkFqTViUyoEOnoHUXGx4WX3uZCmFCyVA6nMeWDgevnvD52:zGporwbnoHU2xZ3uZCUmpmZ+0Ng
TLSH T12356BE19E3DA00B8D42BCB78C655C333E6B0BD965726D50B0A59F6061F73EA08F2F625
TrID 47.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
35.2% (.EXE) InstallShield setup (43053/19/16)
8.6% (.EXE) Win64 Executable (generic) (10522/11/4)
4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter aachum
Tags:dll Rhadamanthys


Avatar
iamaachum
https://www.mediafire.com/file/r699nspmgk5klhn/m%D0%BEdmenu_gta_5.rar/file (password 2025)

Intelligence

File Origin
# of uploads :
2
# of downloads :
629
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
vstdlib_s64.dll
Verdict:
Malicious activity
Analysis date:
2025-03-04 16:42:30 UTC
Tags:
rhadamanthys stealer shellcode
Link:
https://app.any.run/tasks/76a836ca-dd0b-4d4b-8c9c-ba3aaa56cc88

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.23028.12968.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67c72dbac668b65489befb37
Tags:
emotet
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context crypto fingerprint lolbin masquerade microsoft_visual_cc obfuscated packed packed packer_detected remote
Link:
https://www.filescan.io/uploads/67c72d6a3c5f644bd9428749/reports/8d5740b4-eda5-44a6-ab36-75e447695e78/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/68cc07802289ffde1c9047856d1c15e94482d874c60f5e1fc470e8bc59b20f32
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Rhadamanthys
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5eb5c7d9-111e-4bbd-83ab-dafdf7d102bf
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1629406
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sample uses process hollowing technique
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1629406 Sample: vstdlib_s64.dll.exe Startdate: 04/03/2025 Architecture: WINDOWS Score: 100 56 Suricata IDS alerts for network traffic 2->56 58 Found malware configuration 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 3 other signatures 2->62 10 loaddll64.exe 1 2->10         started        process3 process4 12 cmd.exe 1 10->12         started        14 rundll32.exe 10->14         started        17 rundll32.exe 10->17         started        19 12 other processes 10->19 signatures5 21 rundll32.exe 12->21         started        74 Writes to foreign memory regions 14->74 76 Allocates memory in foreign processes 14->76 78 Sample uses process hollowing technique 14->78 24 csc.exe 14->24         started        26 aspnet_wp.exe 14->26         started        80 Injects a PE file into a foreign processes 17->80 28 aspnet_wp.exe 17->28         started        30 aspnet_wp.exe 19->30         started        32 aspnet_wp.exe 19->32         started        34 aspnet_wp.exe 19->34         started        36 7 other processes 19->36 process6 signatures7 64 Writes to foreign memory regions 21->64 66 Allocates memory in foreign processes 21->66 68 Sample uses process hollowing technique 21->68 70 Injects a PE file into a foreign processes 21->70 38 aspnet_wp.exe 1 21->38         started        72 Switches to a custom stack to bypass stack traces 28->72 40 WerFault.exe 2 28->40         started        42 WerFault.exe 2 30->42         started        44 WerFault.exe 2 32->44         started        process8 process9 46 svchost.exe 38->46         started        50 WerFault.exe 2 38->50         started        dnsIp10 54 83.217.208.36, 3876, 49730, 49735 INF-NET-ASRU Russian Federation 46->54 82 System process connects to network (likely due to code injection or exploit) 46->82 84 Switches to a custom stack to bypass stack traces 46->84 52 fontdrvhost.exe 46->52         started        signatures11 process12
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/68cc07802289ffde1c9047856d1c15e94482d874c60f5e1fc470e8bc59b20f32
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68cc07802289ffde1c9047856d1c15e94482d874c60f5e1fc470e8bc59b20f32/
Threat name:
Win32.Ransomware.Rhadamanthys
Create hunting rule
Status:
Malicious
First seen:
2025-03-04 16:42:18 UTC
File Type:
PE+ (Dll)
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ndgapabcrh754heqi6cw2hav5fcifwduyyhv4h6eodulywnsb4za._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery
Link:
https://tria.ge/reports/250304-t7smnswjw4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/4fceba11-3d86-49ef-b9b1-aea2b695d966
Unpacked files
SH256 hash:
68cc07802289ffde1c9047856d1c15e94482d874c60f5e1fc470e8bc59b20f32
MD5 hash:
151b39cf4263b51c7e7997f709808891
SHA1 hash:
11944a076090d1b5b39ba6b52c3a8a9d9683f416
Link:
https://www.unpac.me/results/5837a304-5fca-4d42-8c26-f0f331471d76/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/68cc07802289/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/68cc07802289ffde1c9047856d1c15e94482d874c60f5e1fc470e8bc59b20f32

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Jupyter_infostealer
Create hunting rule
Author:CD_R0M_
Description:Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

Executable exe 68cc07802289ffde1c9047856d1c15e94482d874c60f5e1fc470e8bc59b20f32

(this sample)

  
Link
https://tria.ge/250304-t4za2svvhx/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::OpenProcess
KERNEL32.dll::VirtualAllocEx
KERNEL32.dll::VirtualAllocExNuma
KERNEL32.dll::WriteProcessMemory
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetSystemInfo
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::GetSystemDirectoryW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_BCRYPT_APICan Encrypt Filesbcrypt.dll::BCryptCreateHash
bcrypt.dll::BCryptDestroyHash
bcrypt.dll::BCryptFinishHash
bcrypt.dll::BCryptGenRandom
bcrypt.dll::BCryptGetProperty
bcrypt.dll::BCryptHashData
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW

Comments


Avatar
commented on 2025-03-04 16:43:25 UTC

Rhadamanthys C2: 83.217.208.36