MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8059a627641eb1c31eb14ef8a90a71e482c3fe71df249f17046bf8923dbc1b19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 15

Intelligence 15 IOCs YARA 2 File information Comments

SHA256 hash:	8059a627641eb1c31eb14ef8a90a71e482c3fe71df249f17046bf8923dbc1b19
SHA3-384 hash:	c96a823212aa58fafc1f4315752bccec8c6e4b43f0a8efe0b91a1e48287126cb6c6802edcad331cd585633a14523b0a4
SHA1 hash:	e2ba16cc065e52545fe67e27abb799fc188c0e7b
MD5 hash:	d051550b7085a8ec636c860dbe364757
humanhash:	friend-dakota-rugby-massachusetts
File name:	setup.exe
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	362'496 bytes
First seen:	2023-03-19 13:09:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	322ed0186ab1b10915e176da453e7963 (10 x RedLineStealer, 5 x Rhadamanthys, 2 x Amadey)
ssdeep	6144:sugLVu0QJ1KD4u6w0EDEbCiYyqsE4jbyhC:sugYH1YH0EDUz5Nbjeh
Threatray	290 similar samples on MalwareBazaar
TLSH	T19D744B4383E17C48E9268B739F1EE2E8B71EF671DE597B6532189A1F04B1172C163B90
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	22460802004a2224 (1 x Rhadamanthys)
Reporter	Chainskilabs
Tags:	exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

213

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

setup.exe

Verdict:

Malicious activity

Analysis date:

2023-03-19 13:12:13 UTC

Tags:

rhadamanthys

Link:

https://app.any.run/tasks/c436a32d-3e83-4d3d-b9b9-b28c711f426e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Rhadamanthys

Link:

https://www.capesandbox.com/analysis/375642/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP GET request

Launching a process

Launching the default Windows debugger (dwwin.exe)

Reading critical registry keys

Searching for the window

Unauthorized injection to a system process

Stealing user critical data

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/74082/overview

Behaviour

MalwareBazaar

CPUID_Instruction

MeasuringTime

SystemUptime

EvasionQueryPerformanceCounter

EvasionGetTickCount

CheckCmdLine

Verdict:

Malicious

Threat level:

10/10

Confidence:

80%

Tags:

babar greyware packed

Link:

https://www.filescan.io/uploads/641709adb236355850d6ce89/reports/027e5480-21be-4815-b766-108a2e14f7a4/overview

Verdict:

Malicious

Labled as:

Babar.Generic

Link:

https://www.hybrid-analysis.com/sample/8059a627641eb1c31eb14ef8a90a71e482c3fe71df249f17046bf8923dbc1b19

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a1130511-19a5-4ecd-992f-d7c30c336f81

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1197070

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contain functionality to detect virtual machines

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to hide a thread from the debugger

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Found potential ransomware demand text

Hides threads from debuggers

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Searches for specific processes (likely to inject)

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8059a627641eb1c31eb14ef8a90a71e482c3fe71df249f17046bf8923dbc1b19/

Threat name:

Win32.Spyware.Rhadamanthys

Status:

Malicious

First seen:

2023-03-19 13:10:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qbm2mj3ed2y4ghvrj34ksctr4sbmh7tr34sj6fyenp4jepn4dmmq._file

Verdict:

malicious

Rhadamanthys

2473d2451cb6e066df31a2457c700cd9e0b1585db96716c981b3f34deffdfd26

Rhadamanthys

318fdc3e4e806a8640f03c86d2eadc23dd0a04ce1d1f2ce44710c870749dcf09

Rhadamanthys

4532489becbdf07bc0a932486ab95b497113f5600c7646b635eaea9bcfa430cd

Rhadamanthys

5f1a56b6cfdd55b401ee5e769a7c60ac886f02f5d425d5514e202b9e12448b87

Rhadamanthys

60b346fe162b2fc00328d09a35696cfe21f22925716d15fe9841f5fb9bc629ab

Rhadamanthys

6c89be96a021e75087a7f43cf5cd05293e1d3428c3a051f970cac9ce9895e555

Rhadamanthys

7a78888d3616fa77722ef3e59d343db0d32e43d62b79d911ae06c9a26707da21

Rhadamanthys

7e7d63e3a65bdc7258d659d77b1e66ce07c834ba2897886682e383babfc68da6

Rhadamanthys

ea334e6d6b8c953695cbdb56dd4d1ec6b2269bf241ea7084dc032595e5bca87b

Rhadamanthys

+ 280 additional samples on MalwareBazaar

Result

Malware family:

rhadamanthys

Score:

10/10

Tags:

family:rhadamanthys collection stealer

Link:

https://tria.ge/reports/230319-qedfhaae51/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Detect rhadamanthys stealer shellcode

Rhadamanthys

Unpacked files

SH256 hash:

879e00131fef015ee76a82bd8eb05543fa6a82276c08ef0c4035630952827de1

MD5 hash:

42340e853adbf922e185e3b82077bef1

SHA1 hash:

73dba5b14df609e9afc2b93dfc14f72eba683bbf

Link:

https://www.unpac.me/results/dc73922d-e42d-4e38-a650-88d1e2f0938f/

SH256 hash:

8059a627641eb1c31eb14ef8a90a71e482c3fe71df249f17046bf8923dbc1b19

MD5 hash:

d051550b7085a8ec636c860dbe364757

SHA1 hash:

e2ba16cc065e52545fe67e27abb799fc188c0e7b

Link:

https://www.unpac.me/results/dc73922d-e42d-4e38-a650-88d1e2f0938f/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8059a627641e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8059a627641eb1c31eb14ef8a90a71e482c3fe71df249f17046bf8923dbc1b19

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.