MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8852fce00a05590fda77c900acd65d0ad70422fd73f2dc171f45db0f6f6e867d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments

SHA256 hash:	8852fce00a05590fda77c900acd65d0ad70422fd73f2dc171f45db0f6f6e867d
SHA3-384 hash:	f06590d50e376f9008bcd8d52cc823736ffa3cafa24aeed349288a8f1279d5469aeb38636324c69be64c877c9e10c753
SHA1 hash:	5d0c22e5344b3cad1237610ac982a4208e9f8ddd
MD5 hash:	300b1294745a807573763d0c931b7de3
humanhash:	november-floor-fish-lactose
File name:	file
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	303'616 bytes
First seen:	2023-02-16 12:26:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	613fbf9e2bd5ffef7427bd1f4e55d242 (7 x Smoke Loader, 3 x RedLineStealer, 1 x Rhadamanthys)
ssdeep	3072:GzdejjmILdhBRbq6REyy5FaSNNtYmLZ5WJQgfdh9Xg62Au87JQUZS7W3p6ey5x:U5IL5pena0j55EDXg62f8fd3phy
Threatray	4'537 similar samples on MalwareBazaar
TLSH	T1D1548D13AAA17D51D516CB729E1EE6E8BB1DF560CE59B7762218DA2F04B00F2C273F01
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	a8a8a0888484cc48 (1 x Rhadamanthys)
Reporter	jstrosch
Tags:	exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

226

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2023-02-16 12:27:43 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ce0950d9-166b-415b-a101-9efc25d9d7cd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Rhadamanthys

Link:

https://www.capesandbox.com/analysis/367210/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP GET request

Creating a file in the %AppData% directory

Launching a process

Searching for synchronization primitives

Deleting a recently created file

Launching the default Windows debugger (dwwin.exe)

Reading critical registry keys

Searching for the window

Forced system process termination

Stealing user critical data

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/70864/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

CPUID_Instruction

CheckCmdLine

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/63ee211b4c4a388771890c19/reports/8bf5f2ba-504c-48f7-8097-93277fcb2757/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/8852fce00a05590fda77c900acd65d0ad70422fd73f2dc171f45db0f6f6e867d

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Cobalt Strike

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7fcfda5e-8f9d-4ae0-b5b3-0837b207ad1c

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1177491

Signature

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found potential ransomware demand text

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8852fce00a05590fda77c900acd65d0ad70422fd73f2dc171f45db0f6f6e867d/

Threat name:

Win32.Spyware.Rhadamanthys

Status:

Malicious

First seen:

2023-02-16 12:27:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 25 (84.00%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rbjpzyakavmq7wtxzeakzvs5bllqiix5opznyfy7ixnq633oqz6q._file

Verdict:

malicious

Rhadamanthys

27966f9978a1ed77868b2d7827ff6581d6da7110421bd6179fc5ccca21e65060

Rhadamanthys

5fc3376cb40e9e8f22785c7b90e9e2c00acff1521f65691b33d9dc07195d0e8c

Rhadamanthys

64d1d03c3378be695f30daea3877b732f662fc453dcd03af0f7990467c698a8f

Rhadamanthys

81ec316a2df6429425c8686cac4cccf3e96835ad4f3b4454fd9d96ee0765e6b0

Rhadamanthys

8a8bf4a261ae984007e0da758f9c8c9c609beb83041e91d036ff4ef0ed1bb328

Rhadamanthys

a2ae21d0e3746dd06ac2b1c69517df60e3998d4d3db47d655b1c01504bba21aa

Rhadamanthys

a860f0a0550d4e011d2fa244f01892f163d218f036c273e78851ab383d361843

Rhadamanthys

d85d8e7789de173ab6af6cddbd31fe5c024987627abfa8ae0f42f6e995d1f205

Rhadamanthys

fd19241e3dbb2519f4f10b8e415e5dee056a7f2894bd7b0e7000a544147caf0a

Rhadamanthys

+ 4'527 additional samples on MalwareBazaar

Result

Malware family:

rhadamanthys

Score:

10/10

Tags:

family:rhadamanthys collection discovery spyware stealer

Link:

https://tria.ge/reports/230216-pmrgnahb4t/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

Accesses Microsoft Outlook profiles

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Detect rhadamanthys stealer shellcode

Rhadamanthys

Unpacked files

SH256 hash:

9c0bd64e8888569d9f394853aade64392c431a684452d9bc8f819dfb2d1bac1a

MD5 hash:

016615af8b3cb0a90066b3bedcf65aa9

SHA1 hash:

315dd04a70f9bcc2b62b57846dbfa79426eb5856

Link:

https://www.unpac.me/results/27629af1-1c26-4665-ac05-0e9e70dedfed/

SH256 hash:

8852fce00a05590fda77c900acd65d0ad70422fd73f2dc171f45db0f6f6e867d

MD5 hash:

300b1294745a807573763d0c931b7de3

SHA1 hash:

5d0c22e5344b3cad1237610ac982a4208e9f8ddd

Link:

https://www.unpac.me/results/27629af1-1c26-4665-ac05-0e9e70dedfed/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8852fce00a05/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8852fce00a05590fda77c900acd65d0ad70422fd73f2dc171f45db0f6f6e867d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.