MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 239a4d2a1bbd06edc9d896e87eb11b9b6fd3b0b593ae9446927ab3aece395c1f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	239a4d2a1bbd06edc9d896e87eb11b9b6fd3b0b593ae9446927ab3aece395c1f
SHA3-384 hash:	0a28191f293209177f7675c66f464105c837b16306da8b2d8db439ddf1638884bbd88740951640d7480bd4753b286774
SHA1 hash:	ac1f687f7d4674e0761ff901015f264ff09e0cb0
MD5 hash:	d0236bbc370e8a1d25c5f9e94646f9fc
humanhash:	moon-cardinal-green-failed
File name:	239a4d2a1bbd06edc9d896e87eb11b9b6fd3b0b593ae9446927ab3aece395c1f.bin.exe
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	2'048'512 bytes
First seen:	2025-10-29 06:40:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep	49152:gha6kEm+zDt5LbFwM9ceGmeLfQcBCI7bQIkA:GaPBEDzq2qxQcUI7EIk
TLSH	T14B9533039167C56FD39396BD666F9B96FD6DDC006C7C2E923A0E366D043FAC26760240
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	abuse_ch
Tags:	exe Rhadamanthys

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

89

Origin country :

SE

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

239a4d2a1bbd06edc9d896e87eb11b9b6fd3b0b593ae9446927ab3aece395c1f.bin.exe

Verdict:

No threats detected

Analysis date:

2025-10-28 23:02:50 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/77d1d4ff-8bdc-49e9-be47-4b99cb73433c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/34569/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Lumma-1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6901b71a9942f1282ec9f4c3

Tags:

virus

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for analyzing tools

Creating a window

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

crypt masquerade microsoft_visual_cc obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/6901b71dc13470f84a4aff20/reports/dcffb2c4-d72d-4d10-af03-c56646936661/overview

Hybrid Analysis Jaik.Generic

Verdict:

Malicious

Labled as:

Jaik.Generic

Link:

https://www.hybrid-analysis.com/sample/239a4d2a1bbd06edc9d896e87eb11b9b6fd3b0b593ae9446927ab3aece395c1f

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-10-28T20:05:00Z UTC

Last seen:

2025-10-31T04:35:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-PSW.Win32.Lumma.pef HEUR:Trojan.Win32.Generic Trojan.Win64.SBEscape.sb Trojan.Win32.Strab.sb

Link:

https://opentip.kaspersky.com/239a4d2a1bbd06edc9d896e87eb11b9b6fd3b0b593ae9446927ab3aece395c1f/results?tab=lookup

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/355cef75-f351-4a80-8cfc-6af2385140a3

Joe Sandbox RHADAMANTHYS

Result

Threat name:

RHADAMANTHYS

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1803705

Signature

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Hides threads from debuggers

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/239a4d2a1bbd06edc9d896e87eb11b9b6fd3b0b593ae9446927ab3aece395c1f

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/d0236bbc370e8a1d25c5f9e94646f9fc

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/239a4d2a1bbd06edc9d896e87eb11b9b6fd3b0b593ae9446927ab3aece395c1f/

Neiki Trojan-PSW.Win32.Lumma

Verdict:

Malicious

Threat:

Trojan-PSW.Win32.Lumma

Link:

https://tip.neiki.dev/file/239a4d2a1bbd06edc9d896e87eb11b9b6fd3b0b593ae9446927ab3aece395c1f

ReversingLabs TitaniumCloud Win32.Trojan.Mikey

Threat name:

Win32.Trojan.Mikey

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-28 23:02:51 UTC

File Type:

PE (Exe)

Extracted files:

1

AV detection:

20 of 24 (83.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eone2kq3xudo3soys3uh5mi3tnx5hmfvsoxjiruspkz25trzlqpq._file

Threatray rhadamanthys

Verdict:

malicious

Label(s):

rhadamanthys

Alert

Create hunting rule

Similar samples:

error

Rhadamanthys

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/251029-hf2wgsew4b/

Behaviour

Suspicious behavior: EnumeratesProcesses

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks BIOS information in registry

Identifies Wine through registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/24094599-9cea-4ac6-8337-4fb42fb09cb9

UnpacMe 2

Unpacked files

SH256 hash:

239a4d2a1bbd06edc9d896e87eb11b9b6fd3b0b593ae9446927ab3aece395c1f

MD5 hash:

d0236bbc370e8a1d25c5f9e94646f9fc

SHA1 hash:

ac1f687f7d4674e0761ff901015f264ff09e0cb0

Link:

https://www.unpac.me/results/e500bac7-889e-4266-8e30-d54cb2a84e4e/

SH256 hash:

fde28ea2549fd6541795f16141f489d56647f1776a7b5a8b35e6c057b988c2db

MD5 hash:

9117a0a1402f9a2bfccd25b27c41cb2e

SHA1 hash:

08f93b9a0db93b50806cbc5adadff10ccee0966b

Link:

https://www.unpac.me/results/e500bac7-889e-4266-8e30-d54cb2a84e4e/

VMRay Rhadamanthys

Malware family:

Rhadamanthys

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/239a4d2a1bbd/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/239a4d2a1bbd06edc9d896e87eb11b9b6fd3b0b593ae9446927ab3aece395c1f

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

exe 239a4d2a1bbd06edc9d896e87eb11b9b6fd3b0b593ae9446927ab3aece395c1f

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/3687751/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/34569/