MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ecdf70fe9c6423522d7ed26058a9c705413b923863eddc44cf406d55bbc8f7d9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	ecdf70fe9c6423522d7ed26058a9c705413b923863eddc44cf406d55bbc8f7d9
SHA3-384 hash:	1c02a3a019f810a96cc4f88934e586061fd08cfe550ef209c1183fd03f98a663039e90a90614a5959443fb776c388063
SHA1 hash:	961327ff23c8c578ad91902b03c2c0f61ebaa721
MD5 hash:	e33380cd66cb38cdf6ed3008e1c8154e
humanhash:	don-spring-single-vegan
File name:	factura
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	190'952 bytes
First seen:	2024-04-18 14:01:40 UTC
Last seen:	2024-04-18 15:15:42 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4d14d19b876bbb7a86ffba329be9d956 (1 x Rhadamanthys)
ssdeep	768:lfGgTViahszDOtfGgTViahszDO0jzefGgTViahszDOHefGgTViahszDO:F4WsO94WsOsu4WsOC4WsO
Threatray	1 similar samples on MalwareBazaar
TLSH	T1F914E80973075878C08BC8F2F838C2BE25A95D811EF6529E12B43077A5BD44EEEB9775
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	f0f4e0b2f2e4f4d0 (8 x LummaStealer, 1 x CoinMiner, 1 x Rhadamanthys)
Reporter	rmceoin
Tags:	exe

rmceoin

91.92.253.126/Downloads/Factura_SA161.pdf.lnk
Thu, 11 Apr 2024 09:57:23 GMT
e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc
machine_identifier: nldw3-3-06-42
LNK > mshta http://93.190.140.76/factura > http://93.190.140.76/DisabilityCharge.exe

Decoy: http://93.190.140.76/SA160.pdf

Intelligence

File Origin

# of uploads :

# of downloads :

355

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc.lnk

Verdict:

Malicious activity

Analysis date:

2024-04-18 14:02:09 UTC

Tags:

loader rhadamanthys stealer

Link:

https://app.any.run/tasks/2e16ba17-5d7e-4b59-a970-354a93443b1a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm masquerade overlay

Link:

https://www.filescan.io/uploads/662127e1238e3ee25c58e90d/reports/1576a190-01a7-4237-99d7-bf4fc1560685/overview

Verdict:

Malicious

Labled as:

Fugrafa.Generic

Link:

https://www.hybrid-analysis.com/sample/ecdf70fe9c6423522d7ed26058a9c705413b923863eddc44cf406d55bbc8f7d9

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/25d36d25-1162-424b-8175-a21b601ac21b

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

4 / 100

Link:

https://www.joesandbox.com/analysis/1428155

Behaviour

Behavior Graph:

n/a

Score:

15%

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/ecdf70fe9c6423522d7ed26058a9c705413b923863eddc44cf406d55bbc8f7d9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ecdf70fe9c6423522d7ed26058a9c705413b923863eddc44cf406d55bbc8f7d9/

Threat name:

Win32.Trojan.Strictor

Status:

Malicious

First seen:

2024-04-18 14:02:04 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

6 of 24 (25.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5tpxb7u4mqrvell62jqfrkohavatxerympw5yrgpibwvlo6i67mq._file

Verdict:

malicious

Rhadamanthys

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/240418-rb4c7agb8x/

Unpacked files

SH256 hash:

ecdf70fe9c6423522d7ed26058a9c705413b923863eddc44cf406d55bbc8f7d9

MD5 hash:

e33380cd66cb38cdf6ed3008e1c8154e

SHA1 hash:

961327ff23c8c578ad91902b03c2c0f61ebaa721

Link:

https://www.unpac.me/results/2e2258ef-5462-4e8e-9e4a-839e0d4f25e7/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

lnk e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc

Rhadamanthys

exe ecdf70fe9c6423522d7ed26058a9c705413b923863eddc44cf406d55bbc8f7d9

(this sample)

Rhadamanthys

exe 35ed65d9919843300db648bf93ae57d7330095eb1ce18d6c6050db88a2e4f297

Dropped by

SHA256 e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc

Dropping

SHA256 35ed65d9919843300db648bf93ae57d7330095eb1ce18d6c6050db88a2e4f297

URLhaus

https://urlhaus.abuse.ch/url/2817139/

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2817234/

Dropping

MD5 7def16e0ceea0ad69d53e0e636541dd9

Dropped by

MD5 6b602c96ff01c4f55c7a625b2358a988

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_TRUST_INFO	Requires Elevated Execution (level:requireAdministrator)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegQueryValueExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample