MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8cd2db13b9e1c30d9c1e7b233f1383c54cc794c501db03d92638c5c706a094e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8cd2db13b9e1c30d9c1e7b233f1383c54cc794c501db03d92638c5c706a094e8
SHA3-384 hash: bef3ecb4eec8a0e194d0d741534c30907d14a0f4a132312a03f8fb1d89a4bdd62e985c5a19e3c6656f4701f839bef5d4
SHA1 hash: 08a966dcfd2f72394a8cb9e65c46d67a2cfbb7c6
MD5 hash: 1d9ff0bd9ea42831f3bf1fdb7d0da614
humanhash: ack-pizza-ten-single
File name:8cd2db13b9e1c30d9c1e7b233f1383c54cc794c501db03d92638c5c706a094e8
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:17'355'751 bytes
First seen:2024-10-10 17:47:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d6b0dc1b7cdf65cf7e0ae1b8c64eba7d (2 x Rhadamanthys, 1 x NetSupport, 1 x Gh0stRAT)
ssdeep 393216:8nKVnXcAt/cWmKtNz99Sghe0S+zAQIkCZKNHfFEuOyjqG:wiXcAtkkNzneuIHZaHfFayj7
Threatray 1 similar samples on MalwareBazaar
TLSH T15A073336344045F2F63D17F16AC3AE736AEE2D7F1CD5088866EC31F5A4B562180AD26E
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon c8e2eae6e292c2ee (14 x ArkeiStealer, 10 x RedLineStealer, 3 x Vidar)
Reporter JAMESWT_WT
Tags:198-251-84-78 exe Rhadamanthys

Intelligence

File Origin
# of uploads :
1
# of downloads :
443
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8cd2db13b9e1c30d9c1e7b233f1383c54cc794c501db03d92638c5c706a094e8
Verdict:
Malicious activity
Analysis date:
2024-10-10 17:53:14 UTC
Tags:
arch-exec rhadamanthys stealer upx
Link:
https://app.any.run/tasks/1bdbc523-ed91-485e-89d3-957454f9f830

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67081365f936b5621b0c6635
Tags:
Powershell Ransomware Dropper Blic
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
installer lolbin microsoft_visual_cc overlay packed shell32
Link:
https://www.filescan.io/uploads/67081356906b4a8281d4179d/reports/19828891-0351-416a-9048-2416e4d0e298/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/8cd2db13b9e1c30d9c1e7b233f1383c54cc794c501db03d92638c5c706a094e8
Result
Verdict:
UNKNOWN
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f09eb9ba-2e54-4344-9753-0ea527b51d0f
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
54 / 100
Link:
https://www.joesandbox.com/analysis/1531050
Signature
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes data at the end of the disk (often used by bootkits to hide malicious code)
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1531050 Sample: O1cd60GrHb.exe Startdate: 10/10/2024 Architecture: WINDOWS Score: 54 81 update2.fonelab.com 2->81 83 filecloudvv235.life 2->83 109 Suricata IDS alerts for network traffic 2->109 111 Found malware configuration 2->111 113 Yara detected RHADAMANTHYS Stealer 2->113 115 2 other signatures 2->115 11 O1cd60GrHb.exe 31 2->11         started        signatures3 process4 dnsIp5 95 filecloudvv235.life 104.21.54.168, 443, 49704, 49705 CLOUDFLARENETUS United States 11->95 73 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 11->73 dropped 75 C:\Users\user\AppData\Local\...\INetC.dll, PE32 11->75 dropped 77 C:\Users\user\AppData\Local\Temp\7z.exe, PE32+ 11->77 dropped 79 4 other malicious files 11->79 dropped 127 Writes data at the end of the disk (often used by bootkits to hide malicious code) 11->127 16 data-retriever-x64.exe 2 11->16         started        20 s-etup.exe 11->20         started        22 7z.exe 4 11->22         started        file6 signatures7 process8 file9 59 C:\Users\user\...\data-retriever-x64.tmp, PE32 16->59 dropped 103 Writes data at the end of the disk (often used by bootkits to hide malicious code) 16->103 24 data-retriever-x64.tmp 30 200 16->24         started        105 Injects a PE file into a foreign processes 20->105 107 Switches to a custom stack to bypass stack traces 20->107 28 s-etup.exe 1 20->28         started        61 C:\Users\user\AppData\Local\...\s-etup.exe, PE32 22->61 dropped 63 C:\Users\user\AppData\Local\Temp\...\HID.DLL, PE32 22->63 dropped 30 conhost.exe 22->30         started        signatures10 process11 file12 65 C:\Program Files (x86)\...\is-D20M5.tmp, PE32+ 24->65 dropped 67 C:\Program Files (x86)\...\is-TNF0O.tmp, PE32+ 24->67 dropped 69 C:\Program Files (x86)\...\is-SK6JL.tmp, PE32+ 24->69 dropped 71 236 other files (173 malicious) 24->71 dropped 125 Writes data at the end of the disk (often used by bootkits to hide malicious code) 24->125 32 FoneLab Data Retriever.exe 24->32         started        35 FoneLab Data Retriever.exe 24->35         started        37 FoneLab Data Retriever.exe 24->37         started        39 FoneLab Data Retriever.exe 24->39         started        41 OpenWith.exe 28->41         started        44 WerFault.exe 2 28->44         started        46 WerFault.exe 2 28->46         started        signatures13 process14 dnsIp15 97 Writes data at the end of the disk (often used by bootkits to hide malicious code) 32->97 48 splashScreen.exe 32->48         started        50 chrome.exe 35->50         started        93 198.251.84.78, 49895, 6495 PONYNETUS United States 41->93 99 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 41->99 101 Switches to a custom stack to bypass stack traces 41->101 53 OpenWith.exe 41->53         started        signatures16 process17 dnsIp18 85 192.168.2.5, 443, 49703, 49704 unknown unknown 50->85 87 239.255.255.250 unknown Reserved 50->87 56 chrome.exe 50->56         started        117 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 53->117 119 Tries to steal Mail credentials (via file / registry access) 53->119 121 Found many strings related to Crypto-Wallets (likely being stolen) 53->121 123 2 other signatures 53->123 signatures19 process20 dnsIp21 89 www.google.com 142.250.185.132 GOOGLEUS United States 56->89 91 www.fonelab.com 50.112.40.6 AMAZON-02US United States 56->91
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/8cd2db13b9e1c30d9c1e7b233f1383c54cc794c501db03d92638c5c706a094e8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8cd2db13b9e1c30d9c1e7b233f1383c54cc794c501db03d92638c5c706a094e8/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rtjnwe5z4hbq3ha6pmrt6e4dyvgmpfgfahnqhwjghdc4obvastua._file
Verdict:
malicious
Label(s):
rhadamanthys_dropper
Create hunting rule
rhadamanthys
Create hunting rule
Similar samples:
8cd2db13b9e1c30d9c1e7b233f1383c54cc794c501db03d92638c5c706a094e8
Rhadamanthys
error
Rhadamanthys
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:rhadamanthys discovery stealer upx
Link:
https://tria.ge/reports/241010-wde6latepl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Program Files directory
UPX packed file
Executes dropped EXE
Loads dropped DLL
Suspicious use of NtCreateUserProcessOtherParentProcess
Rhadamanthys
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/7f6c20a4-1dc2-4a8a-a7e1-937265f9bbef
Unpacked files
SH256 hash:
24f6dec8eb5097fef8e6e2acdbf85fcb510f64daee5818572223b3a6a8849ebd
MD5 hash:
2746f5b49ef1a2d17a1d4a290dc45615
SHA1 hash:
26e98eea903b5f34812885ec289e82bcdaeaac07
Link:
https://www.unpac.me/results/8660adac-d41d-4bc2-a453-a2cc503fd11b/
SH256 hash:
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 hash:
40d7eca32b2f4d29db98715dd45bfac5
SHA1 hash:
124df3f617f562e46095776454e1c0c7bb791cc7
Link:
https://www.unpac.me/results/8660adac-d41d-4bc2-a453-a2cc503fd11b/
SH256 hash:
79234d7239ecc95d738c7094644bfe04c0b92b713a75be4e16d291837d5b2291
MD5 hash:
8f96777b409f15754e9af23d1ab2fd68
SHA1 hash:
171ab73b5d5624f715952ea20f6dbf51321a6e9b
Link:
https://www.unpac.me/results/8660adac-d41d-4bc2-a453-a2cc503fd11b/
SH256 hash:
8cd2db13b9e1c30d9c1e7b233f1383c54cc794c501db03d92638c5c706a094e8
MD5 hash:
1d9ff0bd9ea42831f3bf1fdb7d0da614
SHA1 hash:
08a966dcfd2f72394a8cb9e65c46d67a2cfbb7c6
Link:
https://www.unpac.me/results/8660adac-d41d-4bc2-a453-a2cc503fd11b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8cd2db13b9e1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8cd2db13b9e1c30d9c1e7b233f1383c54cc794c501db03d92638c5c706a094e8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_Malicious_VBScript_Base64
Create hunting rule
Author:daniyyell
Description:Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::SetFileSecurityW
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments