MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 545812664008d0b35cf61c15c79526b1d5d05aef886a3f85c9056570fbf13933. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 14


Intelligence 14 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 545812664008d0b35cf61c15c79526b1d5d05aef886a3f85c9056570fbf13933
SHA3-384 hash: 8b0e6e4e7849b9c930542c6d5f0b61f29f0e694c4ba451db71fe1da9123c969f33d2d12ddf871735aa65119c518ea39f
SHA1 hash: bfcbcc7fe783b338ec173eb72fd319971a824dac
MD5 hash: 9015be0c6316088830d6397ecd408c44
humanhash: georgia-iowa-uranus-tango
File name:9015be0c6316088830d6397ecd408c44.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:18'000'408 bytes
First seen:2025-07-19 13:39:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 46ce5c12b293febbeb513b196aa7f843 (14 x GuLoader, 6 x RemcosRAT, 5 x VIPKeylogger)
ssdeep 393216:aZlRJ3T5vBuNBRAjQ29EvpCgLyf6SZtkblE9luaje:aZZtJuNBRJ9gGSfkblE9luaje
Threatray 131 similar samples on MalwareBazaar
TLSH T1AC073307DF012A01EE5EEF719B7EE67CBAC1012685E40EB91912BDD2D395CE5A831372
TrID 37.3% (.EXE) Win64 Executable (generic) (10522/11/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.9% (.EXE) Win32 Executable (generic) (4504/4/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon b298acbab2ca7a72 (2'327 x GCleaner, 1'631 x Socks5Systemz, 67 x RedLineStealer)
Reporter abuse_ch
Tags:exe Rhadamanthys signed

Code Signing Certificate

Organisation:MOTTO IMPEX LLP
Issuer:GlobalSign GCC R45 EV CodeSigning CA 2020
Algorithm:sha256WithRSAEncryption
Valid from:2025-07-11T15:42:50Z
Valid to:2026-07-12T15:42:50Z
Serial number: 0287de9afd1fe6cb92053b30
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 7355716d8bc1631b9549fdf3030b80a758c3efa73809235c523313a0fcb96744
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
29
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9015be0c6316088830d6397ecd408c44.exe
Verdict:
Malicious activity
Analysis date:
2025-07-19 13:42:25 UTC
Tags:
arch-doc arch-html arch-exec stealer rhadamanthys shellcode
Link:
https://app.any.run/tasks/72c8c1c1-0a84-434e-959d-cf73d29dc828

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/15795/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=687ba05984b37dd61eef956b
Tags:
shellcode spoof crypt virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Сreating synchronization primitives
Creating a process from a recently created file
Creating a window
Using the Windows Management Instrumentation requests
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole crypt installer microsoft_visual_cc overlay signed
Link:
https://www.filescan.io/uploads/687ba05612460d69545f69cd/reports/39286294-a4fc-452c-a848-427cd7532449/overview
Verdict:
Malicious
Labled as:
Trojan_Win32_Wacatac_B_ml
Link:
https://www.hybrid-analysis.com/sample/545812664008d0b35cf61c15c79526b1d5d05aef886a3f85c9056570fbf13933
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
81 / 100
Link:
https://www.joesandbox.com/analysis/1740095
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious ZIP file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Python Keylogger
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
53%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/545812664008d0b35cf61c15c79526b1d5d05aef886a3f85c9056570fbf13933
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PDB Path PE (Portable Executable) SVG Win 32 Exe x86
Link:
https://app.malva.re/file/9015be0c6316088830d6397ecd408c44
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/545812664008d0b35cf61c15c79526b1d5d05aef886a3f85c9056570fbf13933/
Verdict:
Malicious
Threat:
Win32.Trojan.Vidar
Link:
https://tip.neiki.dev/file/545812664008d0b35cf61c15c79526b1d5d05aef886a3f85c9056570fbf13933
Threat name:
Win32.Spyware.Rhadamanthys
Create hunting rule
Status:
Malicious
First seen:
2025-07-16 04:24:54 UTC
File Type:
PE (Exe)
Extracted files:
4971
AV detection:
18 of 23 (78.26%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=krmbezsabdilgxhwdqk4pfjgwhk5awxprbvd7bojavsxb67rhezq._file
Verdict:
malicious
Label(s):
rhadamanthys
Create hunting rule
Similar samples:
095b0a89ef2484e672af40ae72288ac65151d637351d9a1dcebbbf048138d46e
Rhadamanthys
1e342385819a0605226b411fe5748f75b33af63ed7d42c30bf61ab361cfa310f
Rhadamanthys
6136c6fc5919bc7e677e087f3616830d25d993f366bd9bfbf5a1a28f1285a438
Rhadamanthys
625c6e19608d92ec4e254bbbeb589509d753cb0d2f0e8333c121cbba249ebc68
Rhadamanthys
64b5ab61bf52abbad72621534950c673c3a58589088ac471ce50795cf406eab9
Rhadamanthys
8c4923f5e0b73bcf0b540e3f033cb21dd5ef91570430fa3fa36206673fb95e0c
Rhadamanthys
a2f1fa7763b8c5a8b4a79e63262f6b8bcdd7e019ac86bfc9b95f0422a874047d
Rhadamanthys
c02278c06102c8709cdf3bc9772818ad261926827ee85f069def82b2e843653d
Rhadamanthys
ea12cb7ea734f9f0bc3e2dd14b4e0bc713cbb15200cc44da2204c179807a9058
Rhadamanthys
error
Rhadamanthys
f7617b6a8a0e8b04a01abb036a9749675f31b530ee1c6da54029611ab6a1aa11
Rhadamanthys
+ 121 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery
Link:
https://tria.ge/reports/250719-qytltsdr7v/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6558f6a4-06d1-4211-adad-add3b2e10fa0
Unpacked files
SH256 hash:
545812664008d0b35cf61c15c79526b1d5d05aef886a3f85c9056570fbf13933
MD5 hash:
9015be0c6316088830d6397ecd408c44
SHA1 hash:
bfcbcc7fe783b338ec173eb72fd319971a824dac
Link:
https://www.unpac.me/results/aba609f1-309e-49a3-bac8-5b21614ab3c2/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/aba609f1-309e-49a3-bac8-5b21614ab3c2/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/aba609f1-309e-49a3-bac8-5b21614ab3c2/
SH256 hash:
47bfeab0eafdc215cf8c73abda9f55d97b2dfcc5bdf9c33c230e662000ad63fd
MD5 hash:
bd7d47d12b2512f17f74e4b5de347df8
SHA1 hash:
a55d66c771514c63d9cd2f0a8c6de84772b0b880
Link:
https://www.unpac.me/results/aba609f1-309e-49a3-bac8-5b21614ab3c2/
SH256 hash:
8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 hash:
9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 hash:
97332a2ffcf12a3e3f27e7c05213b5d7faa13735
Link:
https://www.unpac.me/results/aba609f1-309e-49a3-bac8-5b21614ab3c2/
SH256 hash:
a5ac7ee2add434af74fb3e1ab6ce51b54859e34bbf169826b05813f1e96ab0c6
MD5 hash:
6e3790d6371e3b91685cf12150698545
SHA1 hash:
7f81c73078f4a3d98a3be2feddaba6a1076cd91b
Link:
https://www.unpac.me/results/aba609f1-309e-49a3-bac8-5b21614ab3c2/
SH256 hash:
f4d18fad893cba2ca22a9f9fbd8f3392e3e2797527277f23f0d5914af2cf2ab3
MD5 hash:
daf8f411c292cea715c7f63d6327d520
SHA1 hash:
abd23a20c7a9e7bf2c1b5bd1116cd9f88c37086f
Link:
https://www.unpac.me/results/aba609f1-309e-49a3-bac8-5b21614ab3c2/
SH256 hash:
491b8beb9a82e503e333fab9daa0b14672381308b25b965661296f6c3b256f47
MD5 hash:
9c995ede29ac3b436f2af0ff6e8e4c4e
SHA1 hash:
0d17068bd3abccb6a2804c62fedf6dda10337640
Link:
https://www.unpac.me/results/aba609f1-309e-49a3-bac8-5b21614ab3c2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/545812664008d0b35cf61c15c79526b1d5d05aef886a3f85c9056570fbf13933

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15795/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments