MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d06df702224e7dc86ff07ed2df76b460e07501cc8596b765b15c7b719275a3d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8d06df702224e7dc86ff07ed2df76b460e07501cc8596b765b15c7b719275a3d
SHA3-384 hash: 85c2530596af2bd34432c7cc6243e7f3aa12c6dc693b6a1fdcab34f3882a6637933f9b5b2646df3db05161579e775113
SHA1 hash: e1e9bc2f589a8386453afcf9ab501f6eec8e71eb
MD5 hash: 62263106268dff2ad4d67999d3c1e777
humanhash: bluebird-indigo-sixteen-island
File name:file.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:460'288 bytes
First seen:2023-08-13 01:17:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f14eb02bc6e4e96d4b116ed67da9e223 (4 x Rhadamanthys, 2 x RedLineStealer, 1 x Fabookie)
ssdeep 12288:EYcK7hBBGke2zw+3In0oMQtNMhlrSazp:EZ2hmkeo3Iyservzp
Threatray 19 similar samples on MalwareBazaar
TLSH T1D7A412327A82C473C51B41708422CF619E7F79315A75AA8B33648BBDBE702D15B7B34A
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
16.0% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 0404010124281000 (1 x Rhadamanthys)
Reporter Chainskilabs
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
1
# of downloads :
278
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file.exe
Verdict:
No threats detected
Analysis date:
2023-08-13 01:19:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a422358a-de1d-4bac-8b7d-c17a66a4227f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/442412/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/102715/overview
Behaviour
MalwareBazaar
SystemUptime
CPUID_Instruction
MeasuringTime
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/64d82f4c6999e8f31119b6a4/reports/30d245f0-b95e-40a6-a717-c1cf699bcbb5/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/8d06df702224e7dc86ff07ed2df76b460e07501cc8596b765b15c7b719275a3d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1f488f19-4542-4246-97d5-9581aa4ecd3d
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1290549
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8d06df702224e7dc86ff07ed2df76b460e07501cc8596b765b15c7b719275a3d/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-08-12 15:36:19 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
22 of 38 (57.89%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rudn64bcett5zbx7a7ws353liyhaoua4zbmww5s3cxd3ogjhli6q._file
Verdict:
malicious
Similar samples:
24370dee664ee20b21599b477966ea9a7654a1252c772f5afd50a83c427fa290
Rhadamanthys
2f0f60dbd1f37c1623a927965f7aed2917bfdcd81fb9af697e87afe47e55240a
Rhadamanthys
3cb7602998efd8e8243e1d3890c1d65adb3c335aab4a9c4a2f43c33df5349712
Rhadamanthys
4eb94831dc8c5d208a185b7f83469113379a05db96af352e5c0de634611050dd
Rhadamanthys
960df7d3c618c90075d56b4da9d86a6a00fd8f8b48622fda33938e04356b08e7
Rhadamanthys
a6d0e60e46974bcc2b95d79efe42aef131019e1a1db2f71a780c51a68cc36199
Rhadamanthys
b76d7c7450892b61891be2cbcfdb364e7b6f3c39a30ea1a3727d57b5683cd237
Rhadamanthys
c584c7651362204e41f82b9c0c2c562d5022d5c30f1339a393d9820c25079dbf
Rhadamanthys
eb5d016d4c7014fb7cab49d4e004d33625d1863936c48da07f37011c8e681e56
Rhadamanthys
f58ee9d6f276f787dac4f227f31ea0aa0d28dabba7a686ab77e2380b44cea4f9
Rhadamanthys
+ 9 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:rhadamanthys stealer
Link:
https://tria.ge/reports/230813-bny18sgc79/
Behaviour
Suspicious behavior: EnumeratesProcesses
Program crash
Detect rhadamanthys stealer shellcode
Rhadamanthys
Unpacked files
SH256 hash:
998b06d6f006af0c9c96bf446eab96300b1d9130d5a891c6b22aeaa314d31747
MD5 hash:
76d6f33f858a80073ec383d159127018
SHA1 hash:
360b480b8519c187f0732f9d3a5ac129801ff23c
Detections:
RhadamanthysLoader
Create hunting rule
win_brute_ratel_c4_w0
Create hunting rule
Link:
https://www.unpac.me/results/7a720d07-459f-4307-8921-386910d7f66c/
Parent samples :
f58ee9d6f276f787dac4f227f31ea0aa0d28dabba7a686ab77e2380b44cea4f9
8d06df702224e7dc86ff07ed2df76b460e07501cc8596b765b15c7b719275a3d
67cb319846957d5e7ee3f43e7075c6a7fd4a5275d89f1326bc05c3295baa57ca
0043ce08603751d94a911c887c9fbd583a0914542daec18a75f2055588974d68
9a86c400c754a8a5d191bc77855f398dae45defb82c8821542b7ccd49370a179
b71880c437249e1aae73ab4f9a2377e435ce8e13b8ca2ada12c2019428c50cc0
SH256 hash:
8d06df702224e7dc86ff07ed2df76b460e07501cc8596b765b15c7b719275a3d
MD5 hash:
62263106268dff2ad4d67999d3c1e777
SHA1 hash:
e1e9bc2f589a8386453afcf9ab501f6eec8e71eb
Link:
https://www.unpac.me/results/7a720d07-459f-4307-8921-386910d7f66c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8d06df702224e7dc86ff07ed2df76b460e07501cc8596b765b15c7b719275a3d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

Executable exe 8d06df702224e7dc86ff07ed2df76b460e07501cc8596b765b15c7b719275a3d

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2704069/
Cape
Cape
https://www.capesandbox.com/analysis/442412/

Comments