MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae9768a3474439037f053a672ffae03608fa3e127aa9927b0127b7a22825c62a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae9768a3474439037f053a672ffae03608fa3e127aa9927b0127b7a22825c62a
SHA3-384 hash: 1feab7496faef25db14c0ee03ed9ae6f11fb9feca16d0578f16e9894b9bce7377135dd0f3c0dbfe06080f74eec82d3c2
SHA1 hash: 9456200c2cc28957491a3e9709acbe6fb834a687
MD5 hash: 4247605d401ed13d7584377852052793
humanhash: snake-ceiling-two-spring
File name:4247605d401ed13d7584377852052793.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:15'874'476 bytes
First seen:2024-10-17 08:06:51 UTC
Last seen:2024-10-17 08:39:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d6b0dc1b7cdf65cf7e0ae1b8c64eba7d (2 x Rhadamanthys, 1 x NetSupport, 1 x Gh0stRAT)
ssdeep 393216:Vn8IgucBc26M/Rovs1B7I5RmPAfAmYKYUC0sdeC:58ju8c26MZo26FrYdhYC
Threatray 56 similar samples on MalwareBazaar
TLSH T168F6337A388518E2F53D0BF15B86BAB62CEE5F3F18D4099652E935FA907522081DC13F
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon c8e2eae6e292c2ee (14 x ArkeiStealer, 10 x RedLineStealer, 3 x Vidar)
Reporter abuse_ch
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
2
# of downloads :
387
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4247605d401ed13d7584377852052793.exe
Verdict:
Malicious activity
Analysis date:
2024-10-17 10:26:29 UTC
Tags:
arch-exec rhadamanthys stealer upx
Link:
https://app.any.run/tasks/0aa5cd14-1b86-4abe-b130-44a1f54551cc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Win32.Loader.mbi.21757.1080.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6710c5aa1d4ef219fa63a7ea
Tags:
Shellcode Vmdetect Dropper Remo
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm installer lolbin microsoft_visual_cc overlay packed shell32
Link:
https://www.filescan.io/uploads/6710c5a9b56b3999c74ae9f7/reports/14b11ef9-e363-4f3e-b164-ef7316a4c767/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/ae9768a3474439037f053a672ffae03608fa3e127aa9927b0127b7a22825c62a
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b597c7c2-abfe-427a-9945-d60cb2c13fa0
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1535797
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1535797 Sample: 6rxVO117yJ.exe Startdate: 17/10/2024 Architecture: WINDOWS Score: 72 78 filecloudvv235.life 2->78 88 Suricata IDS alerts for network traffic 2->88 90 Found malware configuration 2->90 92 Yara detected RHADAMANTHYS Stealer 2->92 94 C2 URLs / IPs found in malware configuration 2->94 10 6rxVO117yJ.exe 31 2->10         started        14 msiexec.exe 241 128 2->14         started        signatures3 process4 dnsIp5 82 filecloudvv235.life 104.21.54.168, 443, 49710, 49712 CLOUDFLARENETUS United States 10->82 60 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 10->60 dropped 62 C:\Users\user\AppData\Local\...\INetC.dll, PE32 10->62 dropped 64 C:\Users\user\AppData\Local\Temp\7z.exe, PE32+ 10->64 dropped 72 2 other files (none is malicious) 10->72 dropped 16 s-etup.exe 10->16         started        19 7z.exe 4 10->19         started        22 Power-user.exe 5 10->22         started        66 C:\Windows\Installer\MSI6DC1.tmp, PE32 14->66 dropped 68 C:\Users\user\AppData\...\ARPPRODUCTICON.exe, PE32 14->68 dropped 70 C:\Users\user\AppData\...\msalruntime_x86.dll, PE32 14->70 dropped 74 61 other files (none is malicious) 14->74 dropped 24 msiexec.exe 1 1 14->24         started        26 msiexec.exe 14->26         started        file6 process7 file8 84 Injects a PE file into a foreign processes 16->84 86 Switches to a custom stack to bypass stack traces 16->86 28 s-etup.exe 1 16->28         started        54 C:\Users\user\AppData\Local\...\s-etup.exe, PE32 19->54 dropped 56 C:\Users\user\AppData\Local\Temp\...\HID.DLL, PE32 19->56 dropped 30 conhost.exe 19->30         started        58 C:\Users\user\AppData\...\Power-user.exe, PE32 22->58 dropped 32 Power-user.exe 1 15 22->32         started        34 certutil.exe 8 1 24->34         started        36 WmiPrvSE.exe 24->36         started        signatures9 process10 process11 38 OpenWith.exe 28->38         started        42 WerFault.exe 2 28->42         started        44 WerFault.exe 2 28->44         started        46 msiexec.exe 4 32->46         started        49 conhost.exe 34->49         started        dnsIp12 80 198.251.84.78, 49980, 49991, 6495 PONYNETUS United States 38->80 104 Switches to a custom stack to bypass stack traces 38->104 51 OpenWith.exe 38->51         started        76 C:\Users\user\AppData\Local\...\MSI322F.tmp, PE32 46->76 dropped file13 signatures14 process15 signatures16 96 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 51->96 98 Tries to steal Mail credentials (via file / registry access) 51->98 100 Found many strings related to Crypto-Wallets (likely being stolen) 51->100 102 2 other signatures 51->102
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ae9768a3474439037f053a672ffae03608fa3e127aa9927b0127b7a22825c62a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae9768a3474439037f053a672ffae03608fa3e127aa9927b0127b7a22825c62a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v2lwri2hiq4qg7yfhjts76xagyepupqspkuze6ybe632ekbfyyva._file
Verdict:
malicious
Label(s):
rhadamanthys_dropper
Create hunting rule
rhadamanthys
Create hunting rule
Similar samples:
0f5978c1e5026feea6e28485ceb99b48105d73a77517faf40c1e57d638a5cdd4
Rhadamanthys
11892dbe32cebd618deb6dc36477829ef9fb8181d7ec887408f44c08bb5f675b
Rhadamanthys
876feac850e9030e3aff1b7bd69f85a613d21661e9350b7fa10dd263a61724fe
Rhadamanthys
9474ca1df397ffdc6b0846fc9d0aab58f344fa5ef88da9e4010f8650f5b8995c
Rhadamanthys
ae9768a3474439037f053a672ffae03608fa3e127aa9927b0127b7a22825c62a
Rhadamanthys
c1af977c484a2a05166f9b8d81fcdb709a40a13c66fee6d27cad638a8eba8662
Rhadamanthys
e120256386d8539da0219e924c31e4b4abe88296b0d7a37fe7c76c55f2aa076b
Rhadamanthys
error
Rhadamanthys
+ 46 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:rhadamanthys discovery stealer upx
Link:
https://tria.ge/reports/241017-jz1m7ssenm/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
UPX packed file
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Manipulates Digital Signatures
Rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3b344145-7236-4479-99b4-cc1f5be03fa8
Unpacked files
SH256 hash:
24f6dec8eb5097fef8e6e2acdbf85fcb510f64daee5818572223b3a6a8849ebd
MD5 hash:
2746f5b49ef1a2d17a1d4a290dc45615
SHA1 hash:
26e98eea903b5f34812885ec289e82bcdaeaac07
Link:
https://www.unpac.me/results/faf57d26-d89c-47ef-8658-4692b555b878/
SH256 hash:
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 hash:
40d7eca32b2f4d29db98715dd45bfac5
SHA1 hash:
124df3f617f562e46095776454e1c0c7bb791cc7
Link:
https://www.unpac.me/results/faf57d26-d89c-47ef-8658-4692b555b878/
SH256 hash:
79234d7239ecc95d738c7094644bfe04c0b92b713a75be4e16d291837d5b2291
MD5 hash:
8f96777b409f15754e9af23d1ab2fd68
SHA1 hash:
171ab73b5d5624f715952ea20f6dbf51321a6e9b
Link:
https://www.unpac.me/results/faf57d26-d89c-47ef-8658-4692b555b878/
SH256 hash:
ae9768a3474439037f053a672ffae03608fa3e127aa9927b0127b7a22825c62a
MD5 hash:
4247605d401ed13d7584377852052793
SHA1 hash:
9456200c2cc28957491a3e9709acbe6fb834a687
Link:
https://www.unpac.me/results/faf57d26-d89c-47ef-8658-4692b555b878/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ae9768a34744/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ae9768a3474439037f053a672ffae03608fa3e127aa9927b0127b7a22825c62a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::SetFileSecurityW
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments