MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d137028d8a2aceaa94662fb71620762bdc9780ceebf7122c307644db186e9fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9d137028d8a2aceaa94662fb71620762bdc9780ceebf7122c307644db186e9fe
SHA3-384 hash:	e0b19dbc893df93a7dedbe85da2f6ed3b94dad2b73619e27b05837bdc6671ddc87455f77de3c72d705bd4cf3a0d376b2
SHA1 hash:	ec27978be7338ca691686c5fadd6dc2a168b55df
MD5 hash:	6751e2d1c8d45dd2367b808fa8735262
humanhash:	vegan-ack-alanine-sodium
File name:	6751e2d1c8d45dd2367b808fa8735262.exe
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	408'064 bytes
First seen:	2023-04-28 11:09:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c3c2e3f8654687530e129023a2932873 (2 x Rhadamanthys, 1 x Vidar, 1 x Smoke Loader)
ssdeep	6144:s42E+hZqmFutSgeldahSiuy0gnmgxJeOkHx4dlzuSQIhDRX:B2ZzqmFuUPfaI1AmgxJe56dlzf1DRX
Threatray	292 similar samples on MalwareBazaar
TLSH	T1AC948D1262D12971EA235B728E2EC6E42A1EF5504F157BEF175A5E7F0D709F2C23230A
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	01626e6a6a6a6a60 (11 x Smoke Loader, 11 x Rhadamanthys, 5 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe Rhadamanthys

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

258

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

6751e2d1c8d45dd2367b808fa8735262.exe

Verdict:

Malicious activity

Analysis date:

2023-04-28 11:24:33 UTC

Tags:

rhadamanthys

Link:

https://app.any.run/tasks/b4c612fc-e6b7-41f9-a5f2-6ab589018ac4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Rhadamanthys

Detection:

Rhadamanthys

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/385443/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.28386.32271.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/644ba9921facab193c669acb/reports/bd73698c-d55a-49fc-84ad-bf9eb7a978b1/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/9d137028d8a2aceaa94662fb71620762bdc9780ceebf7122c307644db186e9fe

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Generic Malware

Malware family:

Generic Malware

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6bd85b62-6c0a-412a-94bb-3fcce71c286a

Joe Sandbox RHADAMANTHYS

Result

Threat name:

RHADAMANTHYS

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1222751

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9d137028d8a2aceaa94662fb71620762bdc9780ceebf7122c307644db186e9fe/

ReversingLabs TitaniumCloud Win32.Spyware.Rhadamanthys

Threat name:

Win32.Spyware.Rhadamanthys

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-04-28 08:45:57 UTC

File Type:

PE (Exe)

Extracted files:

57

AV detection:

30 of 37 (81.08%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tujxakgyukwovkkgml5xcyqhmk64s6am527xciwda5se3mmg5h7a._file

Threatray malicious

Verdict:

malicious

Similar samples:

25caeb36fb7ad4771b9da34ef66f247e1fd454ddac33ba35a18d01565fe8121a

Rhadamanthys

2741c6b8d91a8c5a6e89a1b8053693c659ac35f392e35da7d7e5db329f27de94

Rhadamanthys

2a47c2d84f330efa04265b34e7dc1fd149954c5f1110c6896414f313b7ce17a2

Rhadamanthys

3b9d0e62c06caeaf4244ff2fb275a1919fd9e14243fb436dce313c8d9b89faa4

Rhadamanthys

4532489becbdf07bc0a932486ab95b497113f5600c7646b635eaea9bcfa430cd

Rhadamanthys

99c1e9b26ff369764907dd0576d3ac4d9aa4db2f8a85fea23a6dd22ff6df1922

Rhadamanthys

b4c8fc082585c01b0ff64a7088e77ead33433f1a34251aef7f228d86b615b821

Rhadamanthys

c25a91502defaeb2ddebf18571e737185f764c87de4b2d659bb1d3a087929129

Rhadamanthys

d4547527c24bd286f9218a7d165c520e53af7e17e59b475df5d14a45a4e92221

Rhadamanthys

+ 282 additional samples on MalwareBazaar

Hatching Triage rhadamanthys

Result

Malware family:

rhadamanthys

Alert

Create hunting rule

Score:

  10/10

Tags:

family:rhadamanthys stealer

Link:

https://tria.ge/reports/230428-m9qsjafe5x/

Behaviour

Detect rhadamanthys stealer shellcode

Rhadamanthys

Malware Config

C2 Extraction:

http://179.43.142.201/img/favicon.png

UnpacMe 2

Unpacked files

SH256 hash:

1797d67afc3879e8f47e41f157a56268a4a615f3e9b1e40c0b187a7915ee4107

MD5 hash:

9f086efa5c76a33e52fd2c925de924d3

SHA1 hash:

959399bcdd9e81bdb546f9559514dfad357f1361

Link:

https://www.unpac.me/results/26cb47f6-971b-4596-bea2-d97f0748e5d9/

SH256 hash:

9d137028d8a2aceaa94662fb71620762bdc9780ceebf7122c307644db186e9fe

MD5 hash:

6751e2d1c8d45dd2367b808fa8735262

SHA1 hash:

ec27978be7338ca691686c5fadd6dc2a168b55df

Link:

https://www.unpac.me/results/26cb47f6-971b-4596-bea2-d97f0748e5d9/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9d137028d8a2aceaa94662fb71620762bdc9780ceebf7122c307644db186e9fe

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

exe 9d137028d8a2aceaa94662fb71620762bdc9780ceebf7122c307644db186e9fe

(this sample)

Cape

https://www.capesandbox.com/analysis/385443/

  

URLhaus

https://urlhaus.abuse.ch/url/2525167/

  

Delivery method

Distributed via web download

  

URLhaus

https://urlhaus.abuse.ch/url/2519959/