MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49386fd2081c77778a78e36a3463ac0254af06268770ec48e2171ef2b7882d59. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Adware.Generic

Vendor detections: 3

Intelligence 3 IOCs YARA 6 File information Comments

SHA256 hash:	49386fd2081c77778a78e36a3463ac0254af06268770ec48e2171ef2b7882d59
SHA3-384 hash:	916ca73024d8705d418b4c1867a75cc76032c952a2408661207311aae9356e8b0374172cc0e57dbcc00f87c1f66fd88e
SHA1 hash:	7d39f987628504e8dabc533bb3302c96d8d3ce9e
MD5 hash:	b130662db7cf6d1e06dc08abcd634e68
humanhash:	table-mango-mexico-gee
File name:	♦•Rèady•Fîlè•PassW0rd•Is•♦122120•.7z
Download:	download sample
Signature	Adware.Generic Create hunting rule
File size:	11'142'555 bytes
First seen:	2025-03-21 20:32:16 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
Note:	This file is a password protected archive. The password is: 122120
ssdeep	196608:JeT4srl9t4qjIgssiQ/5Lx/Q7pa3qfpaZrjlHqXAiCrioZvVWqCtus8DiZc:5snt4yxnxLx/Qda3aqtK6xvPCtkDiO
TLSH	T1B3B633EDBCFF68C0E38461A9FFE2247671D0342A730746EE292A7D7065E987E5D60850
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	aachum
Tags:	7z Adware.Generic file-pumped pw-122120 Rhadamanthys

iamaachum

https://6meeripw061124z.cfd/file-14d85f165ec90582a811663f8ea19b2c44b6367b/?s=294&pg=0&q=Download&grp=a2726ace92d220f98f48036c8097f0ddb209bde7 =>https://mega.nz/file/CF1jzAqA#-IvaI5yrcUapWPji2Eify5r-h5ZieTQfqwVRR-qNzZQ/67ddcaf768913_67ddcaf76891a/sdm/60f26c9e6a18a9cc1e9f759e985ea8a8dbf70a34

Rhadamanthys C2: 109.120.139.137

Intelligence

File Origin

# of uploads :

# of downloads :

128

Origin country :

File Archive Information

This file is a password protected archive. The password is: 122120

This file archive contains 1 file(s), sorted by their relevance:

File name:	Setup.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	703'550'494 bytes
SHA256 hash:	bcab2576ef87c395a3557d7a37c0adb4301d505dbc094db8ab1ada431d8429c8
MD5 hash:	346dd809e0074e840f0b9fb8244856a6
De-pumped file size:	1'283'072 bytes (Vs. original size of 703'550'494 bytes)
De-pumped SHA256 hash:	a0da672fdaf8943fc0453424197c5ae5539ed1cc86a47e955ea706a3e8365fe7
De-pumped MD5 hash:	b2b3ff36fcd58ed1b786f1438c29a2fb
MIME type:	application/x-dosexec
Signature	Adware.Generic

Vendor Threat Intelligence

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ddce5a9388e75d078f2e0d

Tags:

n/a

Result

Verdict:

UNKNOWN

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/49386fd2081c77778a78e36a3463ac0254af06268770ec48e2171ef2b7882d59/

Threat name:

Binary.Trojan.Generic

Status:

Suspicious

First seen:

2025-03-21 20:33:10 UTC

File Type:

Binary (Archive)

AV detection:

3 of 24 (12.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=je4g7uqidr3xpcty4nvdiy5majkk6brgq5yoyshcc4ppfn4ifvmq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)