MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 733c3e3bf1651f0090a868eebd3670e880f489a2a6a19e47be04fa08eca38623. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 733c3e3bf1651f0090a868eebd3670e880f489a2a6a19e47be04fa08eca38623
SHA3-384 hash: a4c8a2201c6291c5f197962c4ac2271f66b14a95cc16b823815d579137f30229d0b2ebed8dda2f0ff1f7769065207cfe
SHA1 hash: 81d1b693b2774c18c820d079823d7b87b29b8286
MD5 hash: 326cc532d49bb68d5583030a11f4ffb5
humanhash: september-pasta-maine-ohio
File name:setup.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:2'420'736 bytes
First seen:2023-03-21 02:05:31 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 49152:dvk3Qg8ZRwkUBnlHPRFzg7uGmuLoaUIFJL:dvkO
Threatray 9 similar samples on MalwareBazaar
TLSH T1C9B58DB262A3FE86D7BF2E60C0483A409C64546393ADC789FCC925A746E5350EF5C7B1
TrID 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
11.2% (.SCR) Windows screen saver (13097/50/3)
9.0% (.EXE) Win64 Executable (generic) (10523/12/4)
5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter Chainskilabs
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
1
# of downloads :
250
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
setup.exe
Verdict:
Malicious activity
Analysis date:
2023-03-21 02:08:34 UTC
Tags:
rhadamanthys
Link:
https://app.any.run/tasks/ca356d6d-0c58-40d5-80b0-f86880e7b0b1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/376073/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6419110bda1bbe29caf93e63/reports/fa66d8fb-b812-4f2a-9e01-4a03c543462d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/733c3e3bf1651f0090a868eebd3670e880f489a2a6a19e47be04fa08eca38623
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6eb6bf8e-d10a-4329-b920-514e8f7bc975
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1198197
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Checks if the current machine is a virtual machine (disk enumeration)
Encrypted powershell cmdline option found
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 831097 Sample: setup.exe Startdate: 21/03/2023 Architecture: WINDOWS Score: 100 22 Snort IDS alert for network traffic 2->22 24 Multi AV Scanner detection for domain / URL 2->24 26 Antivirus detection for URL or domain 2->26 28 8 other signatures 2->28 7 setup.exe 4 2->7         started        process3 file4 20 C:\Users\user\AppData\Local\...\setup.exe.log, ASCII 7->20 dropped 30 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 7->30 32 Encrypted powershell cmdline option found 7->32 11 RegAsm.exe 7->11         started        14 RegAsm.exe 7->14         started        16 powershell.exe 14 7->16         started        signatures5 process6 signatures7 34 Query firmware table information (likely to detect VMs) 11->34 36 Hides threads from debuggers 11->36 38 Checks if the current machine is a virtual machine (disk enumeration) 11->38 40 Tries to detect sandboxes / dynamic malware analysis system (registry check) 11->40 42 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 14->42 44 Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines) 14->44 46 Queries memory information (via WMI often done to detect virtual machines) 14->46 18 conhost.exe 16->18         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/733c3e3bf1651f0090a868eebd3670e880f489a2a6a19e47be04fa08eca38623/
Threat name:
Win32.Spyware.Rhadamanthys
Create hunting rule
Status:
Suspicious
First seen:
2023-03-20 22:47:43 UTC
AV detection:
16 of 37 (43.24%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=om6d4o7rmupqbefindxl2ntq5capjcncu2qz4r56at5ar3fdqyrq._file
Verdict:
malicious
Similar samples:
06bb6b0d9391858906390cbd9c5e90fcdae91b350e073ddc876d8aea4b9e3f46
Rhadamanthys
43639284cc83ca4b36e9996c616e4dae98fe4e49b2878bb0d4fc07d3fd8ed0ff
Rhadamanthys
47026c159cbc5f8cfe3b3bfe4a999bc45a7c089c89d1e68244088ed1a704fada
Rhadamanthys
65a73b946adeca7edc624d85c9af02b3d607e1e65df2580a32fb143b9c40fc7f
Rhadamanthys
6ef6b791315d1d1581ea617d1837ea8af4db3147ee4ea2ec7cfccc2a5ed11f71
Rhadamanthys
7508dd55323850161d037626592fc56eb6be4cc917c68ba90f3c5866f5c2b59d
Rhadamanthys
9f2e5707c600da27affb9f9219ca42c61b3a2729b693417c42d7baf599526306
Rhadamanthys
a8d22d7ca681510340d5b23b4d2bba492622bdf3052a3cb0a996f1e2e25436aa
Rhadamanthys
df98e5b50efcf7aedf479030e51ca5b9990fad9f0d20d729bb106198ddee923e
Rhadamanthys
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:rhadamanthys evasion stealer
Link:
https://tria.ge/reports/230321-cjebpsad5w/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks for VirtualBox DLLs, possible anti-VM trick
Checks system information in the registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Checks BIOS information in registry
Checks computer location settings
Looks for VMWare Tools registry key
Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VirtualBox Guest Additions in registry
Detect rhadamanthys stealer shellcode
Rhadamanthys
Unpacked files
SH256 hash:
7958533380d9a2f7d3f826d0043d6a553593f079301e613ba7dd1b55bfd1ef34
MD5 hash:
9e7aa9647090ca7c2537e4406ab0e4ed
SHA1 hash:
9ceea1922bf75056584cb020d9c6c54fe196f228
Link:
https://www.unpac.me/results/f17bf92d-95de-4236-bc95-71294db0ce5b/
SH256 hash:
99ab1ab754ec1b48a4408afd1ea2ba62445944cd69c194dd0b0831429f6ac9d3
MD5 hash:
aa9abaaaef8edce4c73dc8276a4128ef
SHA1 hash:
07830eda93b91ed2dc28c6da4c0842407db85381
Link:
https://www.unpac.me/results/f17bf92d-95de-4236-bc95-71294db0ce5b/
SH256 hash:
733c3e3bf1651f0090a868eebd3670e880f489a2a6a19e47be04fa08eca38623
MD5 hash:
326cc532d49bb68d5583030a11f4ffb5
SHA1 hash:
81d1b693b2774c18c820d079823d7b87b29b8286
Link:
https://www.unpac.me/results/f17bf92d-95de-4236-bc95-71294db0ce5b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/733c3e3bf1651f0090a868eebd3670e880f489a2a6a19e47be04fa08eca38623

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

Executable exe 733c3e3bf1651f0090a868eebd3670e880f489a2a6a19e47be04fa08eca38623

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2554569/
Cape
Cape
https://www.capesandbox.com/analysis/376073/

Comments