🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d7e4e4fb4bb46462ead0eb78205ef46407084a64d1a621aea26e5d1d95129c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d7e4e4fb4bb46462ead0eb78205ef46407084a64d1a621aea26e5d1d95129c4
SHA3-384 hash: 0a74e2546550357f4fd60023fe8ead82c2a5fe2b2164ba2b8891c2514e803add68bb0f22697052a0c9694d0ed5505824
SHA1 hash: 888301bc8f419c07364af1f60e3e38c8c544504b
MD5 hash: 1bb536a4baf42af61d08306cc89e93af
humanhash: louisiana-berlin-eleven-nitrogen
File name:radamat.bin
Download: download sample
Signature PureRAT
Create hunting rule
File size:1'699'347 bytes
First seen:2026-11-01 11:38:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'307 x AgentTesla, 20'722 x Formbook, 12'402 x SnakeKeylogger)
ssdeep 49152:Gu9j+BFJ0TH/RTdlgN3GpZbu/I6ICOLx2F+mnvMBk0XdZGnT2Cq5:GWCBFJG/lP6ICOLx2F+mnvMBk0XdZGnc
TLSH T15875B026795802B8D176C276C5C75802D7B278461372EBCF23806B6A2F1B7E99F3E711
TrID 70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win64 Executable (generic) (6522/11/2)
4.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:bin exe PureRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
NETReactor
Details
Link:
https://research.acce.ciphertechsolutions.com/results/fbe9ebdf-6fc6-4e93-8633-ac4b24ded8a8/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-01 12:31:20 UTC
Tags:
purecrypter auto-sch-xml netreactor loader purehvnc pdfwkrnl-sys vuln-driver
Link:
https://app.any.run/tasks/c565a393-0aeb-452f-a034-71708233cd8c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/96561/
Detection(s):
Win.Loader.Generic-10060719-0
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae724c2b121dd519dcf2eb1
Tags:
injection vmdetect obfusc sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Creating synchronization primitives
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Sending a custom TCP request
Forced system process termination
Creating a file
Creating a process from a recently created file
Connection attempt
DNS request
Sending an HTTP GET request
Running batch commands
Creating a file in the %AppData% directory
Creating a service
Launching a service
Loading a system driver
Searching for the window
Enabling autorun for a service
Connection attempt to an infection source
Launching a tool to kill processes
Enabling autorun by creating a file
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm base64 evasive fingerprint fingerprint masquerade net_reactor obfuscated obfuscated overlay packed packed reconnaissance
Link:
https://www.filescan.io/uploads/6ae724b10ec77f71d252eee1/reports/1e23637d-3683-4f0e-bca9-a3ea0bfd713a/overview
Verdict:
Malicious
Labled as:
MSIL.Benin.Generic
Link:
https://www.hybrid-analysis.com/sample/0d7e4e4fb4bb46462ead0eb78205ef46407084a64d1a621aea26e5d1d95129c4
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-11-01T04:54:00Z UTC
Last seen:
2026-11-02T20:31:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/0d7e4e4fb4bb46462ead0eb78205ef46407084a64d1a621aea26e5d1d95129c4/results?tab=lookup
Malware family:
Mistic
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f68fe1f1-6a56-4833-ac21-0c82871f0146
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1996115
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Adds a directory exclusion to Windows Defender
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Creates executable files without a name
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
May modify the system service descriptor table (often done to hook functions)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Sample is not signed and drops a device driver
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Silenttrinity Stager Msbuild Activity
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected MSIL Injector
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1996115 Sample: radamat.bin.exe Startdate: 01/11/2026 Architecture: WINDOWS Score: 100 79 pannki.com 2->79 81 mr-b01.tm-azurefd.net 2->81 83 2 other IPs or domains 2->83 91 Antivirus detection for URL or domain 2->91 93 Antivirus / Scanner detection for submitted sample 2->93 95 Multi AV Scanner detection for submitted file 2->95 97 11 other signatures 2->97 9 .exe 3 2->9         started        12 radamat.bin.exe 9 2->12         started        15 ssgroc.exe 2->15         started        17 10 other processes 2->17 signatures3 process4 dnsIp5 101 Antivirus detection for dropped file 9->101 103 Multi AV Scanner detection for dropped file 9->103 105 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 9->105 20 MSBuild.exe 9->20         started        67 C:\Users\user\AppData\Local\dqtaygvn\.exe, PE32 12->67 dropped 69 C:\Users\user\...\.exe:Zone.Identifier, ASCII 12->69 dropped 71 C:\...\1a8bdc573b094fadb59f1963609b13c7.xml, XML 12->71 dropped 73 C:\Users\user\AppData\...\radamat.bin.exe.log, CSV 12->73 dropped 107 Creates executable files without a name 12->107 109 Uses schtasks.exe or at.exe to add and modify task schedules 12->109 25 schtasks.exe 1 12->25         started        27 schtasks.exe 1 12->27         started        75 C:\Users\user\AppData\...\8v6pc369wfq5.sys, PE32+ 15->75 dropped 111 May modify the system service descriptor table (often done to hook functions) 15->111 113 Sample is not signed and drops a device driver 15->113 115 Found direct / indirect Syscall (likely to bypass EDR) 15->115 29 curl.exe 15->29         started        31 WerFault.exe 15->31         started        77 127.0.0.1 unknown unknown 17->77 117 Writes to foreign memory regions 17->117 119 Injects a PE file into a foreign processes 17->119 33 InstallUtil.exe 17->33         started        35 MpCmdRun.exe 17->35         started        37 conhost.exe 17->37         started        39 WerFault.exe 17->39         started        file6 signatures7 process8 dnsIp9 85 pannki.com 31.31.196.171, 443, 49705, 49707 AS-REGRU Russia 20->85 87 192.69.210.254, 49704, 49713, 49716 WEBNX-WebNXIncUS United States 20->87 65 C:\Users\user\AppData\Local\Temp\ssgroc.exe, PE32+ 20->65 dropped 99 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 20->99 41 cmd.exe 20->41         started        43 schtasks.exe 20->43         started        45 schtasks.exe 20->45         started        47 conhost.exe 25->47         started        49 conhost.exe 27->49         started        89 107.175.82.242, 9000 ONEPROVIDER-ASBrainStormNetworkIncCA United States 29->89 51 conhost.exe 29->51         started        53 conhost.exe 35->53         started        file10 signatures11 process12 process13 55 conhost.exe 41->55         started        57 timeout.exe 41->57         started        59 taskkill.exe 41->59         started        61 conhost.exe 43->61         started        63 conhost.exe 45->63         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0d7e4e4fb4bb46462ead0eb78205ef46407084a64d1a621aea26e5d1d95129c4
Verdict:
Malware
YARA:
13 match(es)
Tags:
.Net .Net Obfuscator .Net Reactor Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.87 Win 32 Exe x86
Link:
https://app.malva.re/file/1bb536a4baf42af61d08306cc89e93af
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d7e4e4fb4bb46462ead0eb78205ef46407084a64d1a621aea26e5d1d95129c4/
Threat name:
ByteCode-MSIL.Trojan.Benin
Create hunting rule
Status:
Malicious
First seen:
2026-11-01 10:02:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bv7e4t5uxndemlvnb23yebppizahbbfgjungegxke3s5dwkrfhca._file
Verdict:
malicious
Label(s):
PureHVNC
Create hunting rule
Link:
https://reports.threatray.com/325300ff-8458-48e8-9f21-cabfe13234d9
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution persistence
Link:
https://tria.ge/reports/261101-nrzhdsww9k/
Behaviour
Delays execution with timeout.exe
Kills process with taskkill
Scheduled Task/Job: Scheduled Task
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Executes dropped EXE
Downloads MZ/PE file
Unpacked files
SH256 hash:
0d7e4e4fb4bb46462ead0eb78205ef46407084a64d1a621aea26e5d1d95129c4
MD5 hash:
1bb536a4baf42af61d08306cc89e93af
SHA1 hash:
888301bc8f419c07364af1f60e3e38c8c544504b
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/2f03ed4d-7178-4588-ba3e-20a22b158f64/
SH256 hash:
bbd15d9a2823608f19dadc169203a12a55f7a582302f90e47dcc60b7d4238428
MD5 hash:
f51c2ebea6b061c3575729ce69c8895c
SHA1 hash:
9ab77fe98ded4252b4ad78bcf3e3b123e40c51b5
Link:
https://www.unpac.me/results/2f03ed4d-7178-4588-ba3e-20a22b158f64/
SH256 hash:
d3a0dc20851f65ab36c3ef2266579cfe4111f415abf1659ccf638ac9ab31afa7
MD5 hash:
7091866455ad2357136ed12f6a1fc26b
SHA1 hash:
1283abc0f6544b9c1bbd5ef5a540e85e76971fb3
Detections:
SUSP_OBF_NET_Reactor_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/2f03ed4d-7178-4588-ba3e-20a22b158f64/
SH256 hash:
7cb176c02468beddcd5772d6c436007f872baff74a0f2cd5e4bed0ea7f991ef4
MD5 hash:
65f668da87e8ffb6aab6b3b0dac783bb
SHA1 hash:
1f9899c3eb645ee520f5d3a24eab86ca56f0ba9f
Link:
https://www.unpac.me/results/2f03ed4d-7178-4588-ba3e-20a22b158f64/
SH256 hash:
7c2302b7409cab562c1a083e7505344911700a3418913818731cf10993ea2b4e
MD5 hash:
71c4f39cd899215c2216f8b82be98c0b
SHA1 hash:
e504b9c4386cb064848d6cd2e983887a8f871e00
Link:
https://www.unpac.me/results/2f03ed4d-7178-4588-ba3e-20a22b158f64/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0d7e4e4fb4bb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
iSpy Keylogger
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0d7e4e4fb4bb46462ead0eb78205ef46407084a64d1a621aea26e5d1d95129c4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Lumma_Stealer_Detection
Create hunting rule
Author:ashizZz
Description:Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_SalatStealer_ForgeAuto_542e717b
Create hunting rule
Author:Marjoriefort
Description:Detects SalatStealer (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_ce8c5b46
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PureRAT

Executable exe 0d7e4e4fb4bb46462ead0eb78205ef46407084a64d1a621aea26e5d1d95129c4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/4049569/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/96561/

Comments