MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a86c400c754a8a5d191bc77855f398dae45defb82c8821542b7ccd49370a179. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 10

Intelligence 10 IOCs YARA 9 File information Comments

SHA256 hash:	9a86c400c754a8a5d191bc77855f398dae45defb82c8821542b7ccd49370a179
SHA3-384 hash:	643ad383834cc0d25301c234e6f17edee17563bbc738c7273b6dee74396c1c0c48b745b22ce5b1d0b740c0a69930ae0f
SHA1 hash:	fd07dbcdb4b4fc03111e1d038130a93787879687
MD5 hash:	291aaeede8238ae450ffe6a23fe3a415
humanhash:	fish-uncle-beer-summer
File name:	291aaeede8238ae450ffe6a23fe3a415.exe
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	468'992 bytes
First seen:	2023-08-13 07:52:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f14eb02bc6e4e96d4b116ed67da9e223 (4 x Rhadamanthys, 2 x RedLineStealer, 1 x Fabookie)
ssdeep	12288:/D4R+BGDqMsk+ivAsRDwls/GlGcKWwCWShp:/8UBGDxsk+ivvwls/EFbwCF
Threatray	27 similar samples on MalwareBazaar
TLSH	T118A401223252C031C65A86B05874DE796EFF75321A39CA973BB907BC6F202D15F7A346
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	0414111320800000 (1 x Rhadamanthys)
Reporter	abuse_ch
Tags:	exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

285

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

291aaeede8238ae450ffe6a23fe3a415.exe

Verdict:

No threats detected

Analysis date:

2023-08-13 08:06:11 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/85b1d36a-46a6-43b9-b4a3-c1b68afdb00c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/442463/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Clean

Maliciousness:

Gathering data

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/9a86c400c754a8a5d191bc77855f398dae45defb82c8821542b7ccd49370a179

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/25599d0e-0494-44d3-8dfd-e120cc69cff9

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1290619

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9a86c400c754a8a5d191bc77855f398dae45defb82c8821542b7ccd49370a179/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2023-08-12 17:57:03 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tkdmiaghksuklumrxr3ykxzzrwxelxx3qleiefkcw7gnje3quf4q._file

Verdict:

malicious

Rhadamanthys

24370dee664ee20b21599b477966ea9a7654a1252c772f5afd50a83c427fa290

Rhadamanthys

2f0f60dbd1f37c1623a927965f7aed2917bfdcd81fb9af697e87afe47e55240a

Rhadamanthys

3cb7602998efd8e8243e1d3890c1d65adb3c335aab4a9c4a2f43c33df5349712

Rhadamanthys

8d06df702224e7dc86ff07ed2df76b460e07501cc8596b765b15c7b719275a3d

Rhadamanthys

960df7d3c618c90075d56b4da9d86a6a00fd8f8b48622fda33938e04356b08e7

Rhadamanthys

b76d7c7450892b61891be2cbcfdb364e7b6f3c39a30ea1a3727d57b5683cd237

Rhadamanthys

c584c7651362204e41f82b9c0c2c562d5022d5c30f1339a393d9820c25079dbf

Rhadamanthys

eb5d016d4c7014fb7cab49d4e004d33625d1863936c48da07f37011c8e681e56

Rhadamanthys

f58ee9d6f276f787dac4f227f31ea0aa0d28dabba7a686ab77e2380b44cea4f9

Rhadamanthys

+ 17 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/230813-jqzdsabg9v/

Behaviour

Program crash

Unpacked files

SH256 hash:

998b06d6f006af0c9c96bf446eab96300b1d9130d5a891c6b22aeaa314d31747

MD5 hash:

76d6f33f858a80073ec383d159127018

SHA1 hash:

360b480b8519c187f0732f9d3a5ac129801ff23c

Detections:

RhadamanthysLoader

win_brute_ratel_c4_w0

Link:

https://www.unpac.me/results/4075c8b3-d7e0-45b4-8fe9-4d7fd2d7767e/

Parent samples :

f58ee9d6f276f787dac4f227f31ea0aa0d28dabba7a686ab77e2380b44cea4f9
8d06df702224e7dc86ff07ed2df76b460e07501cc8596b765b15c7b719275a3d
67cb319846957d5e7ee3f43e7075c6a7fd4a5275d89f1326bc05c3295baa57ca
0043ce08603751d94a911c887c9fbd583a0914542daec18a75f2055588974d68
9a86c400c754a8a5d191bc77855f398dae45defb82c8821542b7ccd49370a179
b71880c437249e1aae73ab4f9a2377e435ce8e13b8ca2ada12c2019428c50cc0

SH256 hash:

9a86c400c754a8a5d191bc77855f398dae45defb82c8821542b7ccd49370a179

MD5 hash:

291aaeede8238ae450ffe6a23fe3a415

SHA1 hash:

fd07dbcdb4b4fc03111e1d038130a93787879687

Link:

https://www.unpac.me/results/4075c8b3-d7e0-45b4-8fe9-4d7fd2d7767e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9a86c400c754a8a5d191bc77855f398dae45defb82c8821542b7ccd49370a179

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BruteSyscallHashes Create hunting rule
Author:	Embee_Research @ Huntress

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

Rule name:	win_bruteratel_syscall_hashes_oct_2022 Create hunting rule
Author:	Embee_Research @ Huntress
Description:	Detection of Brute Ratel Badger via api hashes of Nt* functions.

Rule name:	win_brute_ratel_c4_w0 Create hunting rule
Author:	Embee_Research @ Huntress

Rule name:	win_Brute_Syscall_Hashes Create hunting rule
Author:	Embee_Research @ Huntress
Description:	Detection of Brute Ratel Badger via api hashes of Nt* functions.