MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 678325c74263eb5c55096f3d33bfd9f7020e08083d542ad666226aa71b937560. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 678325c74263eb5c55096f3d33bfd9f7020e08083d542ad666226aa71b937560
SHA3-384 hash: 4399e658def95b4b478cec56dad01c5d9f07313f340116d0426f473d41ff39035d13f5456998e27ce8b1dee25b143479
SHA1 hash: 53629e3f6ba62036ccd4c24929a50fb170650416
MD5 hash: 75a00740ea58d4b46f246681389ba801
humanhash: mockingbird-paris-network-berlin
File name:file
Download: download sample
File size:656'896 bytes
First seen:2025-10-15 04:02:41 UTC
Last seen:2025-10-16 04:06:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 11b5e5a8c80fad621ae3668e21759e30 (7 x Rhadamanthys)
ssdeep 12288:c4+vOlOi2rYBcveyDFFsJdNzOG1XeIBFN:cnOlOnMBTyDTsTtOG1XeIBL
Threatray 344 similar samples on MalwareBazaar
TLSH T1ADD46D9EF53B0DEAC1DF92FB80398259F14328906151862AE7D94137DD872E26F94B3C
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe


Avatar
Bitsight
url: http://178.16.55.189/files/7547858198/lwfTTsU.exe

Intelligence

File Origin
# of uploads :
8
# of downloads :
75
Origin country :
US US
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
random.exe
Verdict:
Malicious activity
Analysis date:
2025-10-14 22:15:50 UTC
Tags:
amadey botnet stealer susp-powershell rdp themida loader remote xworm golang xor-url generic auto pastebin miner winring0-sys vuln-driver stealc vidar gcleaner phishing ultravnc rmm-tool anti-evasion evasion telegram worldwind stormkitty exfiltration ms-smartcard asyncrat rat babel dnguard yano amsi-bypass rustystealer arch-doc autoit lumma silentcryptominer purecrypter
Link:
https://app.any.run/tasks/29e25ed2-e9a6-4f7c-99cc-cc741ed48c86

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/32850/
Detection(s):
SecuriteInfo.com.Trojan.Packed2.50046.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68ef1ceb97a16d00a8da113d
Tags:
spoof virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context crypt infostealer microsoft_visual_cc mikey stealer unsafe
Link:
https://www.filescan.io/uploads/68ef1d1f71883144ef37cd2a/reports/313afd60-1f85-4eb0-a6e0-f3722a4994bb/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/678325c74263eb5c55096f3d33bfd9f7020e08083d542ad666226aa71b937560
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-10-14T13:30:00Z UTC
Last seen:
2025-10-16T12:42:00Z UTC
Hits:
~100
Detections:
VHO:Trojan-PSW.Win32.Crypt.gen VHO:Trojan.Win64.SBEscape.gen Trojan.Win64.SBEscape.iy Trojan.Win32.Crypt.sb
Link:
https://opentip.kaspersky.com/678325c74263eb5c55096f3d33bfd9f7020e08083d542ad666226aa71b937560/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/17083952-0f54-4268-87d0-1a96591f69c0
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/678325c74263eb5c55096f3d33bfd9f7020e08083d542ad666226aa71b937560
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/75a00740ea58d4b46f246681389ba801
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/678325c74263eb5c55096f3d33bfd9f7020e08083d542ad666226aa71b937560/
Verdict:
Malicious
Threat:
Family.LUMMA
Link:
https://tip.neiki.dev/file/678325c74263eb5c55096f3d33bfd9f7020e08083d542ad666226aa71b937560
Threat name:
Win64.Trojan.Radthief
Create hunting rule
Status:
Malicious
First seen:
2025-10-14 16:38:22 UTC
File Type:
PE+ (Exe)
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m6bslr2cmpvvyvijn46thp6z64ba4caihvkcvvtgejvkog4tovqa._file
Verdict:
malicious
Label(s):
rhadamanthys
Create hunting rule
Similar samples:
08f0da421004000e9ac5047c9d42776e36ab511285d19871f6d8370d30d516e5
82628076e3c04a65f04a70b0fb727c43e6ab2e428ce7922b008451dbf7e57b31
968adf76dcc8eea2eeaac8012f34e0c37e45e8a9efce6520d76881213c7b9b3d
af0b1df56ccc89a58a1e3693379e032daa1ce83d29bb6428ad7a187eb216eb2a
b4fd170f2d56421678f4743cba758fb69779b4bfd0f77202dbfc760d8ed1c8e5
b858650183698417edd3c9679935c88d3c4ae4d905566a2757ee1afb0e6383cb
cf101e60653e1a1af54335d9efb4e2942d32b8b8b1be729166ce528b0991e3f2
d01a48586072b4f2fc3182ba97f0e848b4d0b5642a12fc1180d614315d224a8c
d44b1975dc89972c3be507225df6ba9acbed927dac1523d831df0271db3a810a
ecf7e8e17b502ca9e4b6274cf007bb8f9c18d0ad1518ce3911db3e70337958ab
error
+ 334 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251015-emqj9adz5d/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Verdict:
Suspicious
Tags:
loader bazarbackdoor
YARA:
win_bazarbackdoor_auto
Link:
https://app.threat.zone/submission/ef1b5d0c-b320-4857-accf-7cde19aef6f1
Unpacked files
SH256 hash:
678325c74263eb5c55096f3d33bfd9f7020e08083d542ad666226aa71b937560
MD5 hash:
75a00740ea58d4b46f246681389ba801
SHA1 hash:
53629e3f6ba62036ccd4c24929a50fb170650416
Link:
https://www.unpac.me/results/743ee958-5948-482f-a02b-c3168d1266b0/
Malware family:
GoInjector
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/678325c74263/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/678325c74263eb5c55096f3d33bfd9f7020e08083d542ad666226aa71b937560

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 678325c74263eb5c55096f3d33bfd9f7020e08083d542ad666226aa71b937560

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3678480/
Cape
Cape
https://www.capesandbox.com/analysis/32850/

Comments