MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e2f9edbcdc13bb38ce8d4fa86c736c8b21a1d5c6e87500da814cd6757b9c5d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 13


Intelligence 13 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e2f9edbcdc13bb38ce8d4fa86c736c8b21a1d5c6e87500da814cd6757b9c5d1
SHA3-384 hash: 57ad6da7f4b79362650f112f602f97adabbbf6b02f263c2569128575bdec3fd7d93a7dd24321cfc1f43e567bb8e64afe
SHA1 hash: ae34e6acedd0e65ddde052c89d7ff16d17ccdd0f
MD5 hash: 21ebf3caeb75e3c0772182f18d3981fb
humanhash: saturn-william-high-vermont
File name:random.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:2'003'456 bytes
First seen:2025-04-25 08:51:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:gte3ei8B0P+FP1vm30K4R95G4Wtpv7kYX8o:gte3FP+vK4R95GPfv7Js
Threatray 734 similar samples on MalwareBazaar
TLSH T1009533F9DDC372E5EFC59233BD41950C2FAC29604CFF08BC06502669AC5BB5A93B8598
TrID 29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 926b23534d61338c (51 x Rhadamanthys)
Reporter abuse_ch
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
1
# of downloads :
429
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
random.exe
Verdict:
Malicious activity
Analysis date:
2025-04-25 09:38:32 UTC
Tags:
rhadamanthys stealer shellcode
Link:
https://app.any.run/tasks/a44abe8f-0a58-43fc-9bac-dcf5818ab08f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/4049/
Detection(s):
SecuriteInfo.com.Trojan.Lumma-1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=680b50673d067f8483993233
Tags:
virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Searching for the window
Launching a process
Launching the default Windows debugger (dwwin.exe)
Using the Windows Management Instrumentation requests
Connection attempt
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
entropy microsoft_visual_cc packed packed packer_detected rat virtual
Link:
https://www.filescan.io/uploads/680b4d0646fe05453ca6f292/reports/08ab3f5e-a5f2-4f75-aebd-75434b2ac8b4/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/2e2f9edbcdc13bb38ce8d4fa86c736c8b21a1d5c6e87500da814cd6757b9c5d1
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6352f0fc-bbd0-4a3b-94a8-0cebf49a70ec
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1673981
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found malware configuration
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2e2f9edbcdc13bb38ce8d4fa86c736c8b21a1d5c6e87500da814cd6757b9c5d1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e2f9edbcdc13bb38ce8d4fa86c736c8b21a1d5c6e87500da814cd6757b9c5d1/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-04-24 23:26:52 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fyxz5w6nye53hdhi2t5inrzwzczbuhk4n2dvadnictgwov5zyxiq._file
Verdict:
malicious
Label(s):
rhadamanthys
Create hunting rule
Similar samples:
2421394f62d3e79f46138130a67033b7cba3895298e1b0627e9f143adfec7009
Rhadamanthys
3006fbf4ad07f754a252a2d65bbd1df77abdd9361bcc53d8705ab18b6dcecc0f
Rhadamanthys
43753d7fe1487c758cfebd575c0818b13ef5c3c278a0fa9539e04fe1a86553eb
Rhadamanthys
59368bb13783aed758f1df32a0a2db2015333a307ffa9ec188d9f88f7029170b
Rhadamanthys
642aeebc65589ee43e09e3d4066e9519151031c43a7daa8dd6f4823fc804d27c
Rhadamanthys
c2f69012838072f60e8a0b07a0ad3498c029e58243deaf2bd21f450e46c9f6bd
Rhadamanthys
caaa11e780fb9b90c8d6f9f38238429588cf541d1e88b5cfb9e7146f9b147ef7
Rhadamanthys
e11a97236afde003d97440b91a471a73f59fcd2c6f40cc4dde9f7ac57e67ee5d
Rhadamanthys
error
Rhadamanthys
f4d532afb6a34107dde801319d45be7f70a488ccf38590306f8af400f427a48d
Rhadamanthys
+ 724 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion discovery
Link:
https://tria.ge/reports/250425-ksazmsssbx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks BIOS information in registry
Identifies Wine through registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/dab4d5dd-0bb3-4264-ba21-6dee75f73982
Unpacked files
SH256 hash:
2e2f9edbcdc13bb38ce8d4fa86c736c8b21a1d5c6e87500da814cd6757b9c5d1
MD5 hash:
21ebf3caeb75e3c0772182f18d3981fb
SHA1 hash:
ae34e6acedd0e65ddde052c89d7ff16d17ccdd0f
Link:
https://www.unpac.me/results/823f7039-0e2b-4eac-962e-d975ab2a8870/
SH256 hash:
1d61d13d400ba1873993143ac273fa83b71fd1276dc6adc9975d6d6a0d2a2a1b
MD5 hash:
c35ee080b4cf6e632ad6a9b7c5849076
SHA1 hash:
99e46de24b2881a89e7200cd76308d3e53b969cf
Link:
https://www.unpac.me/results/823f7039-0e2b-4eac-962e-d975ab2a8870/
SH256 hash:
46f10a34db89659669b820ce3f812bf5016e3f0c2c21e3e4edb508a0e8a17a07
MD5 hash:
d255da48409929be9c40cb49c522d1ac
SHA1 hash:
8fca978156348450f06826e6beb997301b0231e9
Link:
https://www.unpac.me/results/823f7039-0e2b-4eac-962e-d975ab2a8870/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2e2f9edbcdc1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e2f9edbcdc13bb38ce8d4fa86c736c8b21a1d5c6e87500da814cd6757b9c5d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

Executable exe 2e2f9edbcdc13bb38ce8d4fa86c736c8b21a1d5c6e87500da814cd6757b9c5d1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3522987/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/4049/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments