MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4b1f75feb5864acae90b00168dda506c169334a98bb7a147e33e18725a660a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f4b1f75feb5864acae90b00168dda506c169334a98bb7a147e33e18725a660a4
SHA3-384 hash:	cc8614b8e3afccc6fe065a19762479932d1b1b5bcc806babd5544a96737292f46b26f7f81f0e73c77cb138bf2b04e4c0
SHA1 hash:	061e8bb0bf7b9a6b3efc919d48187cbf6e6d39ed
MD5 hash:	86a6e8316dda14183644539895fbe10d
humanhash:	music-network-nineteen-juliet
File name:	f4b1f75feb5864acae90b00168dda506c169334a98bb7a147e33e18725a660a4
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	34'398'208 bytes
First seen:	2024-08-22 00:32:37 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	786432:inLwZc62Yf1cfloFG/AavUcpjuwi0biBG:iLwaroFWAavUcRN
Threatray	1 similar samples on MalwareBazaar
TLSH	T1637733676EC1EEC2EA387738C0A9838CCF29BD064D5D9C416655327D2EBB3E02379855
TrID	88.4% (.MST) Windows SDK Setup Transform script (61000/1/5) 11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter	JAMESWT_WT
Tags:	91-92-242-111 DanaBot msi Rhadamanthys signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

104

Origin country :

IT

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66c68742b2a4681a729671c1

Tags:

Network Stealth Heur

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

crypto crypto fingerprint installer keylogger packed

Link:

https://www.filescan.io/uploads/66c6873fa47cf488f15af77f/reports/ff562e32-7caa-48af-aa41-aa3f7e188ada/overview

Hybrid Analysis Unknown

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/f4b1f75feb5864acae90b00168dda506c169334a98bb7a147e33e18725a660a4

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/f4b1f75feb5864acae90b00168dda506c169334a98bb7a147e33e18725a660a4

Joe Sandbox DanaBot, RHADAMANTHYS

Result

Threat name:

DanaBot, RHADAMANTHYS

Alert

Create hunting rule

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1497074

Signature

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Connects to many ports of the same IP (likely port scanning)

Detected unpacking (creates a PE file in dynamic memory)

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

May use the Tor software to hide its network traffic

PE file has a writeable .text section

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Execution from Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected DanaBot stealer dll

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/f4b1f75feb5864acae90b00168dda506c169334a98bb7a147e33e18725a660a4

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6sy7ox7llbskzluqwaawrxnfa3awsm2ktc5xufd6gpqyojngmcsa._file

Threatray unknown

Verdict:

unknown

Similar samples:

f4b1f75feb5864acae90b00168dda506c169334a98bb7a147e33e18725a660a4

Rhadamanthys

Hatching Triage rhadamanthys

Result

Malware family:

rhadamanthys

Alert

Create hunting rule

Score:

  10/10

Tags:

family:rhadamanthys collection discovery execution persistence privilege_escalation spyware stealer

Link:

https://tria.ge/reports/240822-av7raayfmd/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Modifies Control Panel

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

outlook_office_path

outlook_win_path

Event Triggered Execution: Installer Packages

Program crash

System Location Discovery: System Language Discovery

Checks installed software on the system

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Accesses Microsoft Outlook accounts

Accesses Microsoft Outlook profiles

Adds Run key to start application

Blocklisted process makes network request

Enumerates connected drives

Reads WinSCP keys stored on the system

Command and Scripting Interpreter: PowerShell

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/92a6d6ff-ed4b-4531-8f95-fd7539c8a4dd

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f4b1f75feb5864acae90b00168dda506c169334a98bb7a147e33e18725a660a4