MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fbfa2a1459b860def9746c56c5ff3dea236a5a97d922e85401e70beb0cd4d07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1fbfa2a1459b860def9746c56c5ff3dea236a5a97d922e85401e70beb0cd4d07
SHA3-384 hash: de51efc380affff7d007a7a537c0ffc15697e03c8cb4d8af38763f45ffd2fd5d25e018b23ffaf1bcec33df3238dadbce
SHA1 hash: 22c4f684c84ce11b7527e927050f1c08a1e5b9ae
MD5 hash: 12a13bad34f107d8da43732c2c6327d4
humanhash: winner-uncle-tennis-oregon
File name:file
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:5'475'328 bytes
First seen:2025-10-01 04:01:02 UTC
Last seen:2025-10-02 04:06:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ff906d5ae0d3218e00c9d571874cb7f8 (3 x Rhadamanthys, 1 x CoinMiner, 1 x Amadey)
ssdeep 49152:ZL4Go7UXQntCMUVDQmE4LZftWb76CTep/MueBOP42EM+MHyXTcAeKbtOiEIIUISl:F4QAtjJ0ptgWTe7VAHKbtDEpWUqh
Threatray 44 similar samples on MalwareBazaar
TLSH T1FE46C083FA930043FBE345B06F29C9A1D8191AE77A2929D680188184D4FDDEFD9B3577
TrID 49.9% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.6% (.EXE) OS/2 Executable (generic) (2029/13)
9.5% (.EXE) Generic Win/DOS Executable (2002/3)
9.4% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe Rhadamanthys


Avatar
Bitsight
url: http://178.16.55.189/files/5296057416/NjtIeMV.exe

Intelligence

File Origin
# of uploads :
7
# of downloads :
99
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
NjtIeMV.exe
Verdict:
Malicious activity
Analysis date:
2025-10-01 00:29:02 UTC
Tags:
anti-evasion rhadamanthys stealer shellcode
Link:
https://app.any.run/tasks/3427600f-5b5c-463b-a0f5-9060e9a7b43e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29651/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68dc75cd40b7da0b4eb903d8
Tags:
cobalt overt spawn crypt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Launching a process
Using the Windows Management Instrumentation requests
DNS request
Connection attempt
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
amadey crypt fingerprint microsoft_visual_cc packed rhadamanthys unsafe xpack
Link:
https://www.filescan.io/uploads/68dca79e674d5fd6aa11fbdd/reports/23fd6376-bdbc-4e0b-8e04-47502afc3480/overview
Verdict:
Malicious
Labled as:
Midie.Generic
Link:
https://www.hybrid-analysis.com/sample/1fbfa2a1459b860def9746c56c5ff3dea236a5a97d922e85401e70beb0cd4d07
Verdict:
Malicious
File Type:
exe x32
Detections:
Trojan.Win32.Strab.sb Trojan.Win32.Inject.sb Trojan.Win32.Crypt.sb Trojan.Win32.Agent.sb Trojan.Win64.SBEscape.sb
Link:
https://opentip.kaspersky.com/1fbfa2a1459b860def9746c56c5ff3dea236a5a97d922e85401e70beb0cd4d07/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/94ee06da-bf83-44bd-a95e-f8d674fa0a10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1fbfa2a1459b860def9746c56c5ff3dea236a5a97d922e85401e70beb0cd4d07
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1fbfa2a1459b860def9746c56c5ff3dea236a5a97d922e85401e70beb0cd4d07/
Verdict:
Malicious
Threat:
Family.RHADAMANTHYS
Link:
https://tip.neiki.dev/file/1fbfa2a1459b860def9746c56c5ff3dea236a5a97d922e85401e70beb0cd4d07
Threat name:
Win32.Trojan.RadThief
Create hunting rule
Status:
Malicious
First seen:
2025-10-01 00:29:03 UTC
File Type:
PE (Exe)
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d672fikftoda334xi3cwyx7t32rdnjnjpwjc5bkadzyl5mgnjudq._file
Verdict:
malicious
Label(s):
rhadamanthys
Create hunting rule
Similar samples:
40552b3060c5758c0351895c93e3aa38234b375ef812e3577a6b6d144aa613cb
Rhadamanthys
415b94605e8ea36e31cf5efbb6262f65d375eec545e67cc1776cde3744a8cf5b
Rhadamanthys
42a594010cb236b34f554ab794beb282468112bf7f234b5c0978e0dc7e5da1a3
Rhadamanthys
666f527c4c079d4e8e46fd3afd40491ba28b8df1fcc7aba30fb333003aeb0352
Rhadamanthys
77ea1145bc499b42106c56b1e3487a6c54d338235b7bdfc2cccd2926127ea1c4
Rhadamanthys
a39eeadcebb774bd9b4273c198c8ce9d93c0ecd3c655325a87a9b040bd2ad495
Rhadamanthys
c7b56b506f592ebc069f645f59b2f91dfe748506e9d3101602cc913a4e9d74b0
Rhadamanthys
d17fbdccb55a602246b26034b6ce9d64ae1c3b5ad48fd93a732d2fb1dd8de6df
Rhadamanthys
+ 34 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:rhadamanthys discovery stealer
Link:
https://tria.ge/reports/251001-elhg9aytez/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Detects Rhadamanthys Payload
Rhadamanthys
Rhadamanthys family
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b84febda-1a2a-4624-876f-026362254a88
Unpacked files
SH256 hash:
1fbfa2a1459b860def9746c56c5ff3dea236a5a97d922e85401e70beb0cd4d07
MD5 hash:
12a13bad34f107d8da43732c2c6327d4
SHA1 hash:
22c4f684c84ce11b7527e927050f1c08a1e5b9ae
Link:
https://www.unpac.me/results/99ae3e82-0d49-4bc5-8cf4-277bb0f8e233/
Malware family:
Rhadamanthys
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1fbfa2a1459b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1fbfa2a1459b860def9746c56c5ff3dea236a5a97d922e85401e70beb0cd4d07

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

Executable exe 1fbfa2a1459b860def9746c56c5ff3dea236a5a97d922e85401e70beb0cd4d07

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3630970/
Cape
Cape
https://www.capesandbox.com/analysis/29651/

Comments