MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e62c14f5f647a97ce419d27826b15c7332fa1da72075a974820d0575ab974f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 15

Intelligence 15 IOCs YARA 2 File information Comments

SHA256 hash:	8e62c14f5f647a97ce419d27826b15c7332fa1da72075a974820d0575ab974f6
SHA3-384 hash:	da7ef30279cc96f588d18da6f379cee243fb5370d68c6e39db0bc07ee7492299d34140a549581c7908e0c48561331d0e
SHA1 hash:	10aa7188d5775c416e6c69503a75dc99a0390b40
MD5 hash:	6f1c57dae4b62c26442a17f31227eaab
humanhash:	purple-autumn-three-missouri
File name:	setup.exe
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	320'000 bytes
First seen:	2023-03-31 01:48:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fde2d3c5c6b5080c428e56f6f2289988 (2 x Stop, 2 x Rhadamanthys, 1 x Amadey)
ssdeep	6144:I+HLR1gCtLywWOVKkqjqXJjDtue7hGgx/MS:I+1gwWwNc5jqXpkeZC
Threatray	415 similar samples on MalwareBazaar
TLSH	T15A64F12273D1C072E55A40794922CAB45A3FB8709B298BCB77A05B7F4E307D1DE7A346
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0044225c2a130b44 (1 x Rhadamanthys)
Reporter	Chainskilabs
Tags:	exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

295

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

setup.exe

Verdict:

Malicious activity

Analysis date:

2023-03-31 01:50:24 UTC

Tags:

rhadamanthys

Link:

https://app.any.run/tasks/42159fa4-2e5b-4938-b503-af3902c2296a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Rhadamanthys

Link:

https://www.capesandbox.com/analysis/378994/

Detection(s):

Sanesecurity.Malware.29155.BadIN.UNOFFICIAL

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP GET request

Launching a process

Launching the default Windows debugger (dwwin.exe)

Reading critical registry keys

Searching for the window

Unauthorized injection to a system process

Stealing user critical data

Sending an HTTP GET request to an infection source

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/75867/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CPUID_Instruction

EvasionGetTickCount

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware lockbit packed ursnif

Link:

https://www.filescan.io/uploads/64263c0f8e162174987d95ac/reports/b3579439-3beb-4eed-8583-67beea41713a/overview

Verdict:

Malicious

Labled as:

Jaik.Generic

Link:

https://www.hybrid-analysis.com/sample/8e62c14f5f647a97ce419d27826b15c7332fa1da72075a974820d0575ab974f6

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/171114ce-3c80-4ee9-ac72-286aec8792dd

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1205664

Signature

C2 URLs / IPs found in malware configuration

Contain functionality to detect virtual machines

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to hide a thread from the debugger

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Found potential ransomware demand text

Hides threads from debuggers

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Searches for specific processes (likely to inject)

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8e62c14f5f647a97ce419d27826b15c7332fa1da72075a974820d0575ab974f6/

Threat name:

Win32.Spyware.Rhadamanthys

Status:

Malicious

First seen:

2023-03-30 07:47:18 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 36 (66.67%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rzrmct27mr5jptsbtutye2yvy4zs7io2oidvvf2iedifowvzot3a._file

Verdict:

malicious

Rhadamanthys

2473d2451cb6e066df31a2457c700cd9e0b1585db96716c981b3f34deffdfd26

Rhadamanthys

4099b352c15d6191c8d98a823c9b95b58baa2bc1c308f06e6697562cd21c339f

Rhadamanthys

419600d0508516026569e661e54e5e7a5d17d47d18cb8f427932bd728d9bc743

Rhadamanthys

4c8efbebe269a6ccc55f1d34531a90f1ea81c4fc834f1791b9c090e6e62338e5

Rhadamanthys

9771913be1a23ba706b953b3b8333e1239e9b6d405fbb8483f0f22548d9160f1

Rhadamanthys

9891812f13690272fc0581c9b68c6fc9d0bbdb30f6715b1a5b8e2040112d811d

Rhadamanthys

b1350d4785b6b3c87ff90e62b03cd4863426c36b92340bc09996bef7a4d8750c

Rhadamanthys

+ 405 additional samples on MalwareBazaar

Result

Malware family:

rhadamanthys

Score:

10/10

Tags:

family:rhadamanthys collection stealer

Link:

https://tria.ge/reports/230331-b8pcjagc38/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses Microsoft Outlook profiles

Detect rhadamanthys stealer shellcode

Rhadamanthys

Unpacked files

SH256 hash:

879e00131fef015ee76a82bd8eb05543fa6a82276c08ef0c4035630952827de1

MD5 hash:

42340e853adbf922e185e3b82077bef1

SHA1 hash:

73dba5b14df609e9afc2b93dfc14f72eba683bbf

Link:

https://www.unpac.me/results/5b848233-4e54-4fe7-bfb6-c5efbe8ad68f/

SH256 hash:

8e62c14f5f647a97ce419d27826b15c7332fa1da72075a974820d0575ab974f6

MD5 hash:

6f1c57dae4b62c26442a17f31227eaab

SHA1 hash:

10aa7188d5775c416e6c69503a75dc99a0390b40

Link:

https://www.unpac.me/results/5b848233-4e54-4fe7-bfb6-c5efbe8ad68f/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8e62c14f5f64/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8e62c14f5f647a97ce419d27826b15c7332fa1da72075a974820d0575ab974f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.