MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5
SHA3-384 hash: effdecd2412a03a744683bd42f0d6a4ffba9601bcc3045fb8debbc2ee4903246d2e24523a86f69d033eb461a89b41436
SHA1 hash: 7ca4f3a36c5edab59111512e2b577bd2b9836525
MD5 hash: 4acdf57f748191b2854578e156e919c7
humanhash: hotel-pasta-juliet-bacon
File name:4acdf57f748191b2854578e156e919c7.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:308'736 bytes
First seen:2023-01-15 13:54:19 UTC
Last seen:2023-01-17 00:38:55 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d82ab6fa138d54a1b95afff39dd9c801 (4 x RedLineStealer, 1 x ArkeiStealer, 1 x RecordBreaker)
ssdeep 6144:dx6dcNuMSPr/tN0NwjUtDTfYuPZN9t/P+BnaRY3JVHXxHJAPSom4:KcNapN0NuE1h+BnSYbxJAPSol
Threatray 17'591 similar samples on MalwareBazaar
TLSH T10564F105B8D0B472D1620938BA75A7D48D3EBCF00E24495B3FB455AA0EF0681AB79FD7
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
3
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4acdf57f748191b2854578e156e919c7.exe
Verdict:
No threats detected
Analysis date:
2023-01-15 13:57:53 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8a48301b-c53a-4793-8631-b14110864e0c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/353103/
Detection(s):
SecuriteInfo.com.Variant.Lazy.284725.11173.15372.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Launching a process
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Detecting VM
Sending an HTTP GET request
Creating a file in the %AppData% directory
Deleting a recently created file
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/60453/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
No Threat
Threat level:
  2/10
Confidence:
67%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63c405b86e31301ffad9a92c/reports/4b38a202-ceb1-481d-b1ab-b8bc398b177b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Khalesi
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0e8d73b8-9db4-4962-b010-edd028bc928c
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1151915
Signature
Allocates memory in foreign processes
Checks if the current machine is a virtual machine (disk enumeration)
Contain functionality to detect virtual machines
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to hide a thread from the debugger
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking system information)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Searches for specific processes (likely to inject)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 784647 Sample: ieKLbUF7Dv.exe Startdate: 15/01/2023 Architecture: WINDOWS Score: 100 27 Snort IDS alert for network traffic 2->27 29 Multi AV Scanner detection for submitted file 2->29 31 Yara detected RHADAMANTHYS Stealer 2->31 33 3 other signatures 2->33 8 ieKLbUF7Dv.exe 1 2->8         started        process3 signatures4 43 Writes to foreign memory regions 8->43 45 Allocates memory in foreign processes 8->45 47 Injects a PE file into a foreign processes 8->47 11 AppLaunch.exe 1 8->11         started        16 conhost.exe 8->16         started        process5 dnsIp6 25 179.43.176.6, 49714, 49721, 80 PLI-ASCH Panama 11->25 23 C:\Users\user\AppData\...\nsis_uns497c8f.dll, PE32+ 11->23 dropped 49 Query firmware table information (likely to detect VMs) 11->49 51 Found evasive API chain (may stop execution after checking system information) 11->51 53 Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines) 11->53 55 10 other signatures 11->55 18 rundll32.exe 11->18         started        file7 signatures8 process9 signatures10 35 System process connects to network (likely due to code injection or exploit) 18->35 37 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->37 39 Tries to steal Mail credentials (via file / registry access) 18->39 41 2 other signatures 18->41 21 WerFault.exe 18->21         started        process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5/
Threat name:
Win32.Spyware.Rhadamanthys
Create hunting rule
Status:
Malicious
First seen:
2023-01-15 01:05:51 UTC
File Type:
PE (Exe)
AV detection:
23 of 26 (88.46%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pye46pij56e3kwk4obrxz2ixhem2mhupyws7zxrfg5rnwyn7sd2q._file
Verdict:
malicious
Similar samples:
591efac1879c1ec4079d2435e256d6ac654031cb477a0ba9b141c84a6ea51eb1
Rhadamanthys
84fcfc88df2041347b749df08d82fdb951f0335567ac9e5f1828e84084542e1f
Rhadamanthys
9146cee3d387cb3d665885b95d885734541f281cbb2a4726b6a59df922a83ee7
Rhadamanthys
b0a22e9a9850fa4356f5603905f45645489ae04d60d630772b3b8227a21b1956
Rhadamanthys
d3308f8b8905c046fa48a7a828b1047511709ad9c7d9b7d4e67ec94083e76c39
Rhadamanthys
e809a311f3bbfcfc796b37783b4bdbd76c4bd59657252ee3fd20150f8a76ccea
Rhadamanthys
ef2dd208f149f8ae0741c2cf4fa5270e8d54c35e161f88aad9b109c679e211a2
Rhadamanthys
fb651d07bc1ee0b1676123399c358c9f3a276448b4938b46cfd2b9b701956913
Rhadamanthys
fee1d36af03a162f70a627c7cd3efa55b0557530d7eefbe8c72026f48b904595
Rhadamanthys
+ 17'581 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:rhadamanthys stealer
Link:
https://tria.ge/reports/230115-q74s6abd7s/
Behaviour
Checks SCSI registry key(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Detect rhadamanthys stealer shellcode
Rhadamanthys
Unpacked files
SH256 hash:
95c6338713b94335654dee63dc3d03463607c91e58d4e17d81f09496626387e4
MD5 hash:
3dc412aaacd8872bc165c1ef4512ecd8
SHA1 hash:
54439a7327a242d5ef8a418ab0fbb45eb06ba6c1
Link:
https://www.unpac.me/results/134d85f3-040e-4e91-b683-229f9ecf1940/
SH256 hash:
7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5
MD5 hash:
4acdf57f748191b2854578e156e919c7
SHA1 hash:
7ca4f3a36c5edab59111512e2b577bd2b9836525
Link:
https://www.unpac.me/results/134d85f3-040e-4e91-b683-229f9ecf1940/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7e09cf3d09ef/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AppLaunch
Create hunting rule
Author:iam-py-test
Description:Detect files referencing .Net AppLaunch.exe
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

Executable exe 7e09cf3d09ef89b5595c70637ce9173919a61e8fc5a5fcde253762db61bf90f5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2508460/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/353103/

Comments