MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd3d92dbd70a75818d00e41fd4f0a8bb345de3ab29cd93de1057a057516fbd7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments

SHA256 hash:	cd3d92dbd70a75818d00e41fd4f0a8bb345de3ab29cd93de1057a057516fbd7a
SHA3-384 hash:	f6ed5495ab333e101a33048962ee7bb000a6202a2f933b8f50b5bb0aae99503963b70e9d21ef1b98f7d8c2342214109e
SHA1 hash:	76418662b6f48755954f69485dc9b8c80160e9bb
MD5 hash:	251f02872b82f32690de58d94c88791f
humanhash:	mockingbird-failed-mexico-floor
File name:	251f02872b82f32690de58d94c88791f.exe
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	285'184 bytes
First seen:	2023-04-25 15:47:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fd12f8d1ea172054b775d38fe9a5aa5d (2 x Rhadamanthys, 1 x Vidar)
ssdeep	6144:kdvdMGCki9AZrvR4iExGwAGXK77BS1LpP0JX:kdvu3kiOxZ4PxGwxWlSwx
TLSH	T10954F121F992C873C48681385425DAB4657BBC608181859F3378EFAF7E713C2DB6B236
TrID	60.4% (.EXE) InstallShield setup (43053/19/16) 14.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.8% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	000010a442213000 (1 x Rhadamanthys)
Reporter	abuse_ch
Tags:	exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

262

Origin country :

Vendor Threat Intelligence

Detection:

Rhadamanthys

Link:

https://www.capesandbox.com/analysis/384865/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/81430/overview

Behaviour

MalwareBazaar

MeasuringTime

CPUID_Instruction

SystemUptime

EvasionQueryPerformanceCounter

CheckCmdLine

EvasionGetTickCount

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6447f6337f560fc72eebffe2/reports/dc2f6983-acf2-4b07-8d3d-89be6699da36/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/cd3d92dbd70a75818d00e41fd4f0a8bb345de3ab29cd93de1057a057516fbd7a

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a80e727e-adb7-4470-a8c6-9905880d12b1

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1220887

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cd3d92dbd70a75818d00e41fd4f0a8bb345de3ab29cd93de1057a057516fbd7a/

Threat name:

Win32.Trojan.Rhadamanthys

Status:

Malicious

First seen:

2023-04-25 15:00:43 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zu6zfw6xbj2yddia4qp5j4fixm2f3y5lfhgzhxqqk6qfoulpxv5a._file

Result

Malware family:

rhadamanthys

Score:

10/10

Tags:

family:rhadamanthys stealer

Link:

https://tria.ge/reports/230425-s8rw4abc23/

Behaviour

Detect rhadamanthys stealer shellcode

Rhadamanthys

Malware Config

C2 Extraction:

http://179.43.142.201/img/favicon.png

Unpacked files

SH256 hash:

1797d67afc3879e8f47e41f157a56268a4a615f3e9b1e40c0b187a7915ee4107

MD5 hash:

9f086efa5c76a33e52fd2c925de924d3

SHA1 hash:

959399bcdd9e81bdb546f9559514dfad357f1361

Link:

https://www.unpac.me/results/ff0f2740-2a93-47a7-a7ca-1c6ee22d1a2b/

SH256 hash:

cd3d92dbd70a75818d00e41fd4f0a8bb345de3ab29cd93de1057a057516fbd7a

MD5 hash:

251f02872b82f32690de58d94c88791f

SHA1 hash:

76418662b6f48755954f69485dc9b8c80160e9bb

Link:

https://www.unpac.me/results/ff0f2740-2a93-47a7-a7ca-1c6ee22d1a2b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cd3d92dbd70a75818d00e41fd4f0a8bb345de3ab29cd93de1057a057516fbd7a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.