MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9acf0763805c33d4dfbdfae22e6b0209fdf4b6557dba5e3679208d23323e5a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	a9acf0763805c33d4dfbdfae22e6b0209fdf4b6557dba5e3679208d23323e5a4
SHA3-384 hash:	4e0f19755f3634c16db9bdd0dcee8a61123a6dee10a733106c77d701425345ffa65e809a2b3d2a7a0bd7697ea8f87331
SHA1 hash:	aada55f0bee1fed44f811a27bf3a1c267e8b618f
MD5 hash:	41741bc698fdf1377f4be987b6d3e320
humanhash:	equal-moon-one-low
File name:	file
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	285'184 bytes
First seen:	2023-02-01 12:55:16 UTC
Last seen:	2023-02-01 14:47:28 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	66bfc39816e8f6ee52bb21c72f57e3c6 (7 x Smoke Loader, 7 x RedLineStealer, 3 x Amadey)
ssdeep	6144:gW8YUSl4LoLrtHJ86jbPdGsLFma9x5hO15Q:gWb/4cLrZJ86jblGKy1
TLSH	T1DC54F13275B0C032C6B240B09924EB94ABFEB5311675A957B7A81A7E6F703D1733734A
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	816a6a6a6a6a6a74 (11 x Smoke Loader, 4 x RedLineStealer, 2 x Amadey)
Reporter	jstrosch
Tags:	exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

210

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2023-02-01 12:57:10 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3e9ae8f9-9203-459b-93f1-cc6fb1363bde

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/358982/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.9096.10588.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP GET request

Creating a file in the %AppData% directory

Launching a process

Deleting a recently created file

Launching the default Windows debugger (dwwin.exe)

Sending a custom TCP request

Reading critical registry keys

Searching for the window

Forced system process termination

Stealing user critical data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lockbit

Link:

https://www.filescan.io/uploads/63da616689bd67c10fdc0119/reports/0b702192-5a84-460d-a53e-b5c810cad71d/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Cobalt Strike

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ce1b64d8-7d03-46b3-b048-d2e16a5b7a13

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1163185

Signature

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a9acf0763805c33d4dfbdfae22e6b0209fdf4b6557dba5e3679208d23323e5a4/

Threat name:

Win32.Infostealer.Rhadamanthus

Status:

Malicious

First seen:

2023-02-01 12:56:10 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 26 (92.31%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vgwpa5ryaxbt2tp336xcfzvqecp56s3fk7n2ly3hsienemzd4wsa._file

Verdict:

malicious

Result

Malware family:

rhadamanthys

Score:

10/10

Tags:

family:rhadamanthys collection discovery spyware stealer

Link:

https://tria.ge/reports/230201-p6cgvafb51/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

Checks installed software on the system

Accesses Microsoft Outlook profiles

Loads dropped DLL

Reads user/profile data of web browsers

Blocklisted process makes network request

Detect rhadamanthys stealer shellcode

Rhadamanthys

Unpacked files

SH256 hash:

9c0bd64e8888569d9f394853aade64392c431a684452d9bc8f819dfb2d1bac1a

MD5 hash:

016615af8b3cb0a90066b3bedcf65aa9

SHA1 hash:

315dd04a70f9bcc2b62b57846dbfa79426eb5856

Link:

https://www.unpac.me/results/7cc810c3-c1e4-419d-84d5-e6b7d949d8bb/

SH256 hash:

a9acf0763805c33d4dfbdfae22e6b0209fdf4b6557dba5e3679208d23323e5a4

MD5 hash:

41741bc698fdf1377f4be987b6d3e320

SHA1 hash:

aada55f0bee1fed44f811a27bf3a1c267e8b618f

Link:

https://www.unpac.me/results/7cc810c3-c1e4-419d-84d5-e6b7d949d8bb/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a9acf0763805/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a9acf0763805c33d4dfbdfae22e6b0209fdf4b6557dba5e3679208d23323e5a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.