MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6066e8ac39197f8975ef8bbac029aefab50a7f0626b5bb7dea7c1d31dd034196. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 3


Intelligence 3 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6066e8ac39197f8975ef8bbac029aefab50a7f0626b5bb7dea7c1d31dd034196
SHA3-384 hash: 9c0e033a3a41cb25b540fadf10375cd7d4e67488d27eb0805e9262e6a63eddf8fceca84510bff9bb7dab30172e59f4dc
SHA1 hash: a1ebd05174e74045109bdf3e2b229ca0ca141ace
MD5 hash: 5df81f0992f0a950d02d95f90e2f7fcc
humanhash: mountain-black-moon-princess
File name:#𝓟𝓊$$𝓒Ōð”ŧð“Ū--7788__Set-ð“Īp_4Normal_𝟛𝟚_𝟞𝟜𝕓𝕚!!!.7z
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:2'926'497 bytes
First seen:2025-03-22 14:31:42 UTC
Last seen:Never
File type: 7z
MIME type:application/x-7z-compressed
Note:This file is a password protected archive. The password is: 7788
ssdeep 49152:bMZOv4W8Jp1X8JNX/gUZSPLWbYxO7ddEAOeQfus4HmB25COjTn5bg7XE6xYtKRlI:bwvW8JpyL45fo7dqhemuRGyCOjT1gA6O
TLSH T171D5330D719E7646D411F93CC62B71E8A524FC26FCF68F68304D692627F6297D024BA4
TrID 57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1)
42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika sevenzip
Reporter aachum
Tags:7z file-pumped pw-7788 Rhadamanthys


Avatar
iamaachum
https://sharecbc6d1.html3.live/?data=eyJpZCI6IjQ3OTEiLCJwdWIiOiJmOTV6b25lLnRvLml0IiwicmVkaXJlY3RTdGVwIjoyLCJ0aW1lc3RhbXAiOjE3NDI2NTI2NTd9 => https://www.mediafire.com/file/ryhyzs9p7iyd0yo/#%F0%9D%93%9F%F0%9D%93%AA$$%F0%9D%93%92O%CC%84%F0%9D%94%BB%F0%9D%93%AE--7788__Set-%F0%9D%93%A4p_4Normal_%F0%9D%9F%9B%F0%9D%9F%9A_%F0%9D%9F%9E%F0%9D%9F%9C%F0%9D%95%93%F0%9D%95%9A!!!.7z.zip/file

Rhadamanthys C2:
http://api.cheperblast.top:443/76ece4d3ab5c60ead288414/9mdrhf7a.79sec

Intelligence

File Origin
# of uploads :
1
# of downloads :
105
Origin country :
ES ES
File Archive Information

This file archive contains 28 file(s), sorted by their relevance:

File name:hmmapi.dll
File size:53'760 bytes
SHA256 hash: e690864568d17dc5d86acca1fdcdb76c878e63c7b4f69e6003f875b99a7cb766
MD5 hash: de3c51584774ad450ed49715bec1e389
MIME type:application/x-dosexec
Signature Rhadamanthys
File name:dgettextTest_switch.mo
File size:102 bytes
SHA256 hash: c14b20d97ba401785dabd278904e70cbc444b9be2c80fe982caf6b6220916db6
MD5 hash: b8341dc0ce94e88a4f93deeecf7c42bf
MIME type:application/x-gettext-translation
Signature Rhadamanthys
File name:bug70958.phpt
File size:270 bytes
SHA256 hash: d1712f8beb243cbfdea2ffcae76567fece1822c21ad3ad574fd1b6ec96a7b02b
MD5 hash: c3cb6daf8b6aeb1878ad651c500df569
MIME type:text/x-c++
Signature Rhadamanthys
File name:P1-1.0.0.tgz.pubkey
File size:451 bytes
SHA256 hash: 8b64c4410a903e582cd13bacbffff391f84b3b115c71375b7da1beea5e9f7ea1
MD5 hash: 5938417c958c9357e0d0d74712a05892
MIME type:text/plain
Signature Rhadamanthys
File name:array_fill_error.phpt
File size:482 bytes
SHA256 hash: 02c5d3b22a19c7ab78450dd1bf2b473fc68c6c893bf041d21861cc0d309ef9a3
MD5 hash: 71e7ebd822dba868a42dd4645b38cc6e
MIME type:text/plain
Signature Rhadamanthys
File name:array_product_variation3.phpt
File size:1'204 bytes
SHA256 hash: 575f6dbb97a028143ed7014e5613097b1c1a91fdec183289c1f913be7a4bea8f
MD5 hash: 9136edd95c9c8cf7627d0c8280c79d23
MIME type:text/plain
Signature Rhadamanthys
File name:xmlwriter_toStream_custom_constructor.phpt
File size:532 bytes
SHA256 hash: aa3f949762a2b215a7b375c14c32b30904558057fb121d6897561e669f2621f6
MD5 hash: e9bb9000b2e672d27356eee92825c3d0
MIME type:text/plain
Signature Rhadamanthys
File name:test-parse-from-format.phpt
File size:3'623 bytes
SHA256 hash: b94d4ac2914668655a9b9be9cedbbae4e85877d52b5ec9d902d324f54a310bf5
MD5 hash: 94a8767389ad79da2165eec388c00fea
MIME type:text/plain
Signature Rhadamanthys
File name:bug81216.phpt
File size:143 bytes
SHA256 hash: 226285a1c93f166473a3b5417fe261e1a38070e4a51b06ba2236b6ed0853b59b
MD5 hash: 174314bd074bedd3ca03b1a0bda049de
MIME type:text/plain
Signature Rhadamanthys
File name:sqmapi.dll
File size:47'512 bytes
SHA256 hash: a029d03aa6cd3ed4d5b3860881937ee255184d430990661e261c1ce32511f56e
MD5 hash: 17094e07fcebded4a4e8602a8c7807cf
MIME type:application/x-dosexec
Signature Rhadamanthys
File name:IEShims.dll
File size:446'464 bytes
SHA256 hash: 96c2e2a352fb04891f570fee7d6c23fbd5a7ed7e975270e60924ed884bd3b0cf
MD5 hash: 4f5a0476f56e171ecb9f76b80c5611ea
MIME type:application/x-dosexec
Signature Rhadamanthys
File name:install.ins
File size:464 bytes
SHA256 hash: d356750c35dcdb61927011c821f48267e60ddde87b52cd778a74ec0d122327ae
MD5 hash: e343531223a7910cc06dab49333323b8
MIME type:text/plain
Signature Rhadamanthys
File name:fast-finish-fiber.phpt
File size:279 bytes
SHA256 hash: 82fb0b5b47e4a03e5f06ff5a187ce327543466a84fde4d4f4c60a4d685878f74
MD5 hash: 174a658388043a6c2b37c8ec3096b733
MIME type:text/plain
Signature Rhadamanthys
File name:ctype_space_basic.phpt
File size:410 bytes
SHA256 hash: a79655df7d70fd95a18987d0019a7b82abe49d4223e6ff298432f98d7702ba46
MD5 hash: ee22b3726cb13e359d0ead29aad5a05d
MIME type:text/plain
Signature Rhadamanthys
File name:yield_non_ref_function_call_by_ref_error.phpt
File size:317 bytes
SHA256 hash: 154ffbe04a85bee30215aab95b61be372d8778117b758f2c8c6e16fdec77feb9
MD5 hash: cf5c5c3cc3bec8e41f5464027ea0eb39
MIME type:text/plain
Signature Rhadamanthys
File name:hmmapi.dll.mui
File size:2'560 bytes
SHA256 hash: f890488bd96bf2f242fc54ff2512faaaa99456981e6a32a89f1411d75f15a9b5
MD5 hash: ac8b76839efc87cc81839c1f55aa3f80
MIME type:application/x-dosexec
Signature Rhadamanthys
File name:php_cli_server_009.phpt
File size:1'255 bytes
SHA256 hash: 7a008ddc73e922111ae719e34b20ff095ba7537e3dbfb96632850e1b55443bba
MD5 hash: f905ba8733e3d24e27fc16f0152a17d4
MIME type:text/plain
Signature Rhadamanthys
File name:property_override_privateStatic_protected.phpt
File size:458 bytes
SHA256 hash: 9dd34fe6f7a4a8fcc61898b82023d4bdd4cd4e667d584b546e6b85fa8ca82c88
MD5 hash: 10eb2367302172669b079fcef730616d
MIME type:text/x-c++
Signature Rhadamanthys
File name:iexplore.exe.mui
File size:5'632 bytes
SHA256 hash: 9c9c069b284bc9e11261bf7adb558248ab704982f327ba7cb6358aa3961bee60
MD5 hash: 2313d696e61e76b66a4bd533e8fc7e51
MIME type:application/x-dosexec
Signature Rhadamanthys
File name:ReflectionFunction_getDocComment.001.phpt
File size:607 bytes
SHA256 hash: 63a063017451c992f44bf4b476ce195c504dafea60c12acf5ef31d11ba746b3a
MD5 hash: 3572cf26065f20eba23af790fa365d2d
MIME type:text/plain
Signature Rhadamanthys
File name:ddl2.phpt
File size:868 bytes
SHA256 hash: 7546135057c87d651ee8f0b8ec2539c297b7a0cd853258fcbf41ae907a1bc9c6
MD5 hash: 7bbe9574954ad98d6656a3d404027d5c
MIME type:text/plain
Signature Rhadamanthys
File name:ieinstal.exe.mui
File size:2'560 bytes
SHA256 hash: 30e98af04a31e9997182ccf8e6c5ba8c1fa85f88ec63fc44faeb261560aed7c4
MD5 hash: 4a7efa69fe460062fe0c9a4b4b03b5c8
MIME type:application/x-dosexec
Signature Rhadamanthys
File name:bug37251.phpt
File size:258 bytes
SHA256 hash: ec9736e8d862e157536c0d406cec2e22d6afc3805408795016e3775bac9873cf
MD5 hash: ce7655fc0096f49397cf346f4b9314b8
MIME type:text/x-c++
Signature Rhadamanthys
File name:throwing_error_handler_001.phpt
File size:1'959 bytes
SHA256 hash: b9d618436da2eef016f2715230823c7ad01a2dc9485b0ffb5691307383404d5b
MD5 hash: 17d841659b0fe6774659a6de93774d53
MIME type:text/x-c++
Signature Rhadamanthys
File name:bug53958.phpt
File size:858 bytes
SHA256 hash: f902a009151cdf5235ebcd9ddca2079e27063c3b81240645dbf13dd3ca3fb116
MD5 hash: 2b03e563d43fe89aa76a0252ccc0d2eb
MIME type:text/plain
Signature Rhadamanthys
File name:openssl_pkcs12_export_to_file_basic.phpt
File size:2'120 bytes
SHA256 hash: 538834e259399ae0c1fc2b651b63dc4fafee0c7824746315d9f3e57343ecd78e
MD5 hash: 3d5f69a4812a30f4ad79d9b7b74dbb4e
MIME type:text/plain
Signature Rhadamanthys
File name:ns_087.phpt
File size:422 bytes
SHA256 hash: 33d30ae59249bb6c74aeded091ca752f8f8999532583be2c1c9778bf68f227f3
MD5 hash: 2b0516ac45d9ae3118f3cbb35053d439
MIME type:text/x-c++
Signature Rhadamanthys
File name:InstaII.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:700'000'000 bytes
SHA256 hash: 392f813d3121f5ae4f0001ac54ce166bd0ddb5c5f7d981d18f33aff865519852
MD5 hash: e7ce2bb2e139864fbc22ced9b13a109b
De-pumped file size:4'053'504 bytes (Vs. original size of 700'000'000 bytes)
De-pumped SHA256 hash: caaa11e780fb9b90c8d6f9f38238429588cf541d1e88b5cfb9e7146f9b147ef7
De-pumped MD5 hash: ffbc670fc9c4b2fde90e34a9ca4ee592
MIME type:application/x-dosexec
Signature Rhadamanthys
Vendor Threat Intelligence
Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67dec9f8518d210202e7ed39
Tags:
n/a
Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6066e8ac39197f8975ef8bbac029aefab50a7f0626b5bb7dea7c1d31dd034196/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-03-22 13:14:54 UTC
File Type:
Binary (Archive)
AV detection:
3 of 24 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mbtorlbzdf7ys5ppro5makno7k2qu7yge223w7pkpqotdxidigla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:HUNTING_SUSP_TLS_SECTION
Create hunting rule
Author:chaosphere
Description:Detect PE files with .tls section that can be used for anti-debugging
Reference:Practical Malware Analysis - Chapter 16
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

7z 6066e8ac39197f8975ef8bbac029aefab50a7f0626b5bb7dea7c1d31dd034196

(this sample)

Rhadamanthys

Executable exe caaa11e780fb9b90c8d6f9f38238429588cf541d1e88b5cfb9e7146f9b147ef7

  
Link
https://tria.ge/250322-rhtgkayks3/behavioral1
  
Delivery method
Distributed via web download
  
Dropping
SHA256 caaa11e780fb9b90c8d6f9f38238429588cf541d1e88b5cfb9e7146f9b147ef7
  
Dropping
MD5 ffbc670fc9c4b2fde90e34a9ca4ee592
  
Dropping
SHA256 03efac4b1c306959a4211c4dc3f39a937b315bba1b85e95ed8e3d3ebff04e736
  
Dropping
MD5 8fd4c1c0a4d67c8a0490b14cc2d220c9

Comments