MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c89be96a021e75087a7f43cf5cd05293e1d3428c3a051f970cac9ce9895e555. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 15

Intelligence 15 IOCs YARA 2 File information Comments

SHA256 hash:	6c89be96a021e75087a7f43cf5cd05293e1d3428c3a051f970cac9ce9895e555
SHA3-384 hash:	5a7227974223426a90dc91a20160854ca66014301c5b73bc36128cbb5148663cd486aacd2456cbe183d5eab32770314c
SHA1 hash:	a6e4661890c2cdc806f417f11bdf9291912ac1e4
MD5 hash:	34028d17ff60959c1ee9715112ab6aec
humanhash:	xray-yankee-white-ack
File name:	34028d17ff60959c1ee9715112ab6aec.exe
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	351'744 bytes
First seen:	2023-03-10 12:18:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2419dca19886d17884c312786a5b3a55 (9 x RedLineStealer, 4 x Amadey, 2 x Smoke Loader)
ssdeep	6144:gG4LX52wSWiJA9oYsL/O2D/OewLR6e46gnQZgUm:gG4L5JAJA+Yamw/OeLe4TQZE
Threatray	254 similar samples on MalwareBazaar
TLSH	T1B974CF93F3E17CE0F5660A329E6EDEE87ADFF2114E54261782D49A1F05782B1C663309
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	001adac890b28688 (1 x Rhadamanthys)
Reporter	abuse_ch
Tags:	exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

203

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

34028d17ff60959c1ee9715112ab6aec.exe

Verdict:

Malicious activity

Analysis date:

2023-03-10 12:26:35 UTC

Tags:

rhadamanthys

Link:

https://app.any.run/tasks/b4648277-76f3-492c-95d0-ba013dd5d0c0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Rhadamanthys

Link:

https://www.capesandbox.com/analysis/373353/

Detection(s):

Sanesecurity.Malware.28986.BadIN.UNOFFICIAL

Sanesecurity.Malware.28988.BadIN.UNOFFICIAL

Sanesecurity.Malware.28876.BadIN.UNOFFICIAL

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP GET request

Launching a process

Launching the default Windows debugger (dwwin.exe)

Reading critical registry keys

Searching for the window

Unauthorized injection to a system process

Stealing user critical data

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/72529/overview

Behaviour

MalwareBazaar

CPUID_Instruction

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

CheckCmdLine

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

azorult babar greyware lockbit

Link:

https://www.filescan.io/uploads/640b203c449b92860ca7ecf7/reports/2a1f0ca2-9b0f-4ba7-905a-2eb74eb02b00/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/6c89be96a021e75087a7f43cf5cd05293e1d3428c3a051f970cac9ce9895e555

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1a7ddc55-870c-4182-a1f9-5814ce95eda9

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1191300

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Contain functionality to detect virtual machines

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to hide a thread from the debugger

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Found potential ransomware demand text

Hides threads from debuggers

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Searches for specific processes (likely to inject)

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6c89be96a021e75087a7f43cf5cd05293e1d3428c3a051f970cac9ce9895e555/

Threat name:

Win32.Trojan.SmokeLoader

Status:

Malicious

First seen:

2023-03-09 17:47:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nse35fvaehtvbb5h6q6pltiffe7b2nbiyoqfd6lqzle45gev4vkq._file

Verdict:

malicious

Rhadamanthys

4fc39495038014b3e49eb088c92c9310487beca6a027ebc72d60607a05b4f331

Rhadamanthys

563458d0d35d3e4a7809630809229fbe2977eabeb8639ceb677426308c156a3c

Rhadamanthys

7aadc76471387981789a8aa1d2c34ed48b79f84febe3160feea5f32c4aaaceb7

Rhadamanthys

7d16edee6fbccf5bcb73691b8f69113f3e80c804d66b49e71be48ef21eea30b5

Rhadamanthys

91ae44bd5a35834354cc69c2e04f9260cbf7025d18ec59af558f4213b81d7403

Rhadamanthys

95df8e09db02d2956bdd6a91041e3424020e9dc1e2775bac33b6c0af30fada43

Rhadamanthys

+ 244 additional samples on MalwareBazaar

Result

Malware family:

rhadamanthys

Score:

10/10

Tags:

family:rhadamanthys collection stealer

Link:

https://tria.ge/reports/230310-pg7lpafd2y/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Detect rhadamanthys stealer shellcode

Rhadamanthys

Unpacked files

SH256 hash:

647d583c6277b08aaa669df9cd5668b2e1a8d34e0c88d7e956da630fba17dc4e

MD5 hash:

1bfc6944eb93a1740a8cbdca38ff08d4

SHA1 hash:

d787348b8ff8d4888f7073e4103f5f7e30584b54

Link:

https://www.unpac.me/results/139826b4-ab8d-4010-aeb3-42fc9873f315/

SH256 hash:

6c89be96a021e75087a7f43cf5cd05293e1d3428c3a051f970cac9ce9895e555

MD5 hash:

34028d17ff60959c1ee9715112ab6aec

SHA1 hash:

a6e4661890c2cdc806f417f11bdf9291912ac1e4

Link:

https://www.unpac.me/results/139826b4-ab8d-4010-aeb3-42fc9873f315/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6c89be96a021/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6c89be96a021e75087a7f43cf5cd05293e1d3428c3a051f970cac9ce9895e555

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.