MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18c5e368c3eaf2aeec1384a23df25b67ed99495c33567a605a7dc6905ad56c8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 17


Intelligence 17 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18c5e368c3eaf2aeec1384a23df25b67ed99495c33567a605a7dc6905ad56c8c
SHA3-384 hash: 65429b7c87f6a93588d4fd4e48a4991b75378a70df2d34419a8cb004030e0b20bc730200683320a2602fe56618a6c129
SHA1 hash: a520be63f13b0bcccb881160146c7cf6fcb4c132
MD5 hash: 04627b90fa2ef4f4a851452bf5dcf6f7
humanhash: cat-colorado-california-california
File name:ZamICay.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:873'984 bytes
First seen:2025-08-27 10:40:45 UTC
Last seen:2025-08-27 12:04:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d7d2a39cff7498362b68f69f8e68c14e (1 x Rhadamanthys, 1 x LummaStealer)
ssdeep 24576:QVntyozF5rg/4OLs8JibBrJOocsO37Lk7:QiozF5c/4iPib1UrLk7
Threatray 129 similar samples on MalwareBazaar
TLSH T1A4051201F4C380A3FA5320712A79DB68843DBA739F205DD7B1986A64DAB85C65733B1F
TrID 49.9% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.6% (.EXE) OS/2 Executable (generic) (2029/13)
9.5% (.EXE) Generic Win/DOS Executable (2002/3)
9.4% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Joker
Tags:exe lumma Rhadamanthys

Intelligence

File Origin
# of uploads :
2
# of downloads :
70
Origin country :
US US
Vendor Threat Intelligence
Malware family:
quasar
Create hunting rule
ID:
1
File name:
bomb.exe
Verdict:
Malicious activity
Analysis date:
2025-08-27 00:34:02 UTC
Tags:
auto coinminer miner github loader stealc stealer hausbomber lumma evasion quasar rat remote arch-doc payload ultravnc rmm-tool snake keylogger telegram themida amadey exfiltration botnet redline smtp netreactor bittorrent vidar mozi rdpwrap rdp metasploit backdoor meterpreter ims-api generic framework ms-smartcard ta558 apt stegocampaign sliver reverseloader ftp agenttesla pyinstaller upx xmrig rhadamanthys tinynuke pecompact
Link:
https://app.any.run/tasks/9cc15ced-5c3e-47a5-ac6f-81b2e8920b6e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/23852/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68aee0c33e988eb6ab82ccce
Tags:
cobalt spawn virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/68aee0d81c81c34281d5254f/reports/729cd101-5dd6-485e-ab7a-8c458583869d/overview
Verdict:
Malicious
Labled as:
Trojan.TP.Generic
Link:
https://www.hybrid-analysis.com/sample/18c5e368c3eaf2aeec1384a23df25b67ed99495c33567a605a7dc6905ad56c8c
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-08-26T19:31:00Z UTC
Last seen:
2025-08-26T19:31:00Z UTC
Hits:
~10
Detections:
Trojan-PSW.Win32.Crypt.fa Trojan.Win64.SBEscape.sb Trojan.Win32.Strab.sb Trojan.Win32.Inject.sb Trojan.Win32.Crypt.sb Trojan.Win32.Agent.sb
Link:
https://opentip.kaspersky.com/18c5e368c3eaf2aeec1384a23df25b67ed99495c33567a605a7dc6905ad56c8c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4933e584-62be-4e02-a17d-da5e7eeaf44b
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/18c5e368c3eaf2aeec1384a23df25b67ed99495c33567a605a7dc6905ad56c8c
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/04627b90fa2ef4f4a851452bf5dcf6f7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18c5e368c3eaf2aeec1384a23df25b67ed99495c33567a605a7dc6905ad56c8c/
Verdict:
Malicious
Threat:
Family.LUMMA
Link:
https://tip.neiki.dev/file/18c5e368c3eaf2aeec1384a23df25b67ed99495c33567a605a7dc6905ad56c8c
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-08-26 22:21:09 UTC
File Type:
PE (Exe)
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ddc6g2gd5lzk53atqsrd34s3m7wzssk4gnlhuyc2pxdjawwvnsga._file
Verdict:
malicious
Label(s):
rhadamanthys
Create hunting rule
Similar samples:
0955b2e9f532c0401c7b12ba899674145e1c6ae2e6fa30cf03b2a636eaacc4fa
Rhadamanthys
2b178cce1ca7cabd3b59ecce0f73fa78bb889fdb652de5fc61aead23e5ad5aaa
Rhadamanthys
3c2d3dd2705831ed8bd4fc730ee21877b8a28b54455c0332e3eeba157707bcb7
Rhadamanthys
516d9daee48799c22090e64835e99df3d6a6384e9305bfa90287486c4e9881be
Rhadamanthys
c2aab7f25230b2cac2abeedac1309f1be0701cb6593684886bd0a73182480de1
Rhadamanthys
c2eeeef83d6a7c470cccd364369d227ba7665b1c128f5e5128f47d508be9c4db
Rhadamanthys
c3d9dd9bab61c9f89d63481bb2bb18083dfe6f6a661310ed428b9efa893b65e7
Rhadamanthys
dfefecdf2c569ef791a177e51d1927067b763b92780750e990455f7518ae8ab7
Rhadamanthys
error
Rhadamanthys
+ 119 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:rhadamanthys discovery stealer
Link:
https://tria.ge/reports/250827-mractsypv9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Detects Rhadamanthys Payload
Rhadamanthys
Rhadamanthys family
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c7ab6561-b450-4e77-b5da-b6ac8d06fba9
Unpacked files
SH256 hash:
18c5e368c3eaf2aeec1384a23df25b67ed99495c33567a605a7dc6905ad56c8c
MD5 hash:
04627b90fa2ef4f4a851452bf5dcf6f7
SHA1 hash:
a520be63f13b0bcccb881160146c7cf6fcb4c132
Link:
https://www.unpac.me/results/3dbea88b-685c-43a7-b238-010d2d0d7245/
SH256 hash:
aa87fd3c97df76f85ec8e339a342a1b9eae08d4e92dc4ae368e12200ee75ec1f
MD5 hash:
69ebcab73b9d037baa1ae4aced3cf559
SHA1 hash:
bc56de4b5322de0d913dcc212fdc51b180daa294
Link:
https://www.unpac.me/results/3dbea88b-685c-43a7-b238-010d2d0d7245/
Malware family:
Rhadamanthys
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/18c5e368c3ea/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/18c5e368c3eaf2aeec1384a23df25b67ed99495c33567a605a7dc6905ad56c8c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

Executable exe 18c5e368c3eaf2aeec1384a23df25b67ed99495c33567a605a7dc6905ad56c8c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3611620/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/23852/

Comments