MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 654a4d8ff592e34d09c44e6c0d95f9a93bb6361a9c9e069ada5815dd922990bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 10


Intelligence 10 IOCs YARA 75 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 654a4d8ff592e34d09c44e6c0d95f9a93bb6361a9c9e069ada5815dd922990bb
SHA3-384 hash: 4be262e31c91ad120a39d7a917aecafbec886442b55cf19c8377e248e8f92c356b1c7e105d24c8c853df01d10e6aa73b
SHA1 hash: 37234435d7e0612e030e15938c45a97c8fa21e80
MD5 hash: 53b3ecc96a74a90024c3ad375d68558f
humanhash: ceiling-coffee-enemy-ten
File name:SETUP.zip
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:3'567'189 bytes
First seen:2025-09-08 17:46:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:ryyx74kzh25kQymEcB8kb15YRlo8/vs2oWFklF:lx7z25nymEcB8AcMWFg
TLSH T1A2F523ACB472B99EF1D5027BC5822CB6DB2CA440E7893C8B8D204566BE9310F5F7BC55
Magika zip
Reporter aachum
Tags:file-pumped Rhadamanthys RustyStealer SmokeLoader zip


Avatar
iamaachum
https://iesgjkvlks.online/K5R7Dsa3Pkm16cBCVxtSU8br4jvNAYpT2dZXMzogF=o1esDhk4lf5ZCAV6q9QpmG0a3MjvEWRubHFiBgIxLXU=gvP8fyoi4HZ9WrpkMKDs5FalQ7A6IxLRYOE3cdCwVTNJ1m2&p_title=iMc32nO6KB1mRZWhyYa049gsV5D => https://www.mediafire.com/file/tjcn7xk1cmwzagy/%C2%ABYursFileReady_PassW%C3%96rdI%C5%9C__%C2%AB%C2%AB2244%C2%BB%C2%BB.zip/file

File contains 2 executables: Pumped SmokeLoader sample and Rhadamanthys sample.

Intelligence

File Origin
# of uploads :
1
# of downloads :
330
Origin country :
ES ES
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:setup.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:138'850'656 bytes
SHA256 hash: d4efe4aa93ebe1e4dd2ca18119532ab9bb54f3a4b916bedb7e0300f1f468703c
MD5 hash: 573fdf9a59f4f5685bd5b2ea163a7141
De-pumped file size:2'527'744 bytes (Vs. original size of 138'850'656 bytes)
De-pumped SHA256 hash: 524a7b017d628cf5aeef6bd84777b690c6eaf52a0e4fa243d4e6727d950ed96a
De-pumped MD5 hash: fb33e75a02baad89681d429b2b9712f9
MIME type:application/x-dosexec
Signature RustyStealer
File name:Setup.exe
File size:2'413'024 bytes
SHA256 hash: 49384d1b446055cb7893bfc2ecd48a2ac2c3c1ebba90cd1355447017fc35ddd7
MD5 hash: 65e30d646615548ae73340e76782a621
MIME type:application/x-dosexec
Signature Rhadamanthys
Vendor Threat Intelligence
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68bf168b6e66ba602d793349
Tags:
injection obfusc virus
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/654a4d8ff592e34d09c44e6c0d95f9a93bb6361a9c9e069ada5815dd922990bb/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm expired-cert golang invalid-signature mingw obfuscated rozena signed
Link:
https://www.filescan.io/uploads/68bf16cfa7b97e046b931293/reports/7f44fe13-46b6-40de-a0f7-b97e6e7fa87f/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/654a4d8ff592e34d09c44e6c0d95f9a93bb6361a9c9e069ada5815dd922990bb
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/654a4d8ff592e34d09c44e6c0d95f9a93bb6361a9c9e069ada5815dd922990bb
Verdict:
Malicious
File Type:
zip
First seen:
2025-09-08T18:08:00Z UTC
Last seen:
2025-09-08T18:08:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/654a4d8ff592e34d09c44e6c0d95f9a93bb6361a9c9e069ada5815dd922990bb/results?tab=lookup
Score:
97%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/654a4d8ff592e34d09c44e6c0d95f9a93bb6361a9c9e069ada5815dd922990bb
Verdict:
Malware
YARA:
3 match(es)
Tags:
CVE-2019-13232 CVE-2019-9674 CVE-2022-29225 CVE-2022-36114 CVE-2023-46104 CVE-2024-0450 Executable Malicious PE (Portable Executable) PE File Layout Zip Archive Zip Bomb
Link:
https://app.malva.re/file/53b3ecc96a74a90024c3ad375d68558f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/654a4d8ff592e34d09c44e6c0d95f9a93bb6361a9c9e069ada5815dd922990bb/
Threat name:
Win32.Trojan.Etset
Create hunting rule
Status:
Malicious
First seen:
2025-09-08 17:51:23 UTC
File Type:
Binary (Archive)
Extracted files:
109
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mvfe3d7vslru2coejzwa3fpzve53mnq2tspangw2lak53erjsc5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/654a4d8ff592e34d09c44e6c0d95f9a93bb6361a9c9e069ada5815dd922990bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_Golang_Binary
Create hunting rule
Author:Andrew Morrow
Description:Detects binaries compiled with Go
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:HUNTING_SUSP_TLS_SECTION
Create hunting rule
Author:chaosphere
Description:Detect PE files with .tls section that can be used for anti-debugging
Reference:Practical Malware Analysis - Chapter 16
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:win_epsilon_red_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.epsilon_red.
Rule name:win_upx_packed
Create hunting rule
Author:Reedus0
Description:Rule for detecting UPX packed malware

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

zip 654a4d8ff592e34d09c44e6c0d95f9a93bb6361a9c9e069ada5815dd922990bb

(this sample)

RustyStealer

Executable exe 41b89f483fdfe5e08f69045b52685a008b4fcb042569b752f686770fbea162b8

  
Link
https://tria.ge/250908-v264jsgp5z/behavioral2
anyrun
any.run
https://app.any.run/tasks/d0f8e4e5-03fe-475d-a696-70a1e8325ed2
  
Delivery method
Distributed via web download
  
Dropping
SHA256 41b89f483fdfe5e08f69045b52685a008b4fcb042569b752f686770fbea162b8
  
Dropping
MD5 8fa4b8f5d1ae61ba8f4538e70b4099c5
  
Dropping
SHA256 49384d1b446055cb7893bfc2ecd48a2ac2c3c1ebba90cd1355447017fc35ddd7
  
Dropping
MD5 65e30d646615548ae73340e76782a621
  
Dropping
SHA256 524a7b017d628cf5aeef6bd84777b690c6eaf52a0e4fa243d4e6727d950ed96a
  
Dropping
MD5 fb33e75a02baad89681d429b2b9712f9

Comments