MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb
SHA3-384 hash:	e7608f181f786f145e3381a89ac96bcdc2b9cb3a8e5fc76bb4794f07e8f357c65cbc50900ad5d39218d8868fd92460e7
SHA1 hash:	2986fd9d86d80ff9671052073c18eff61131f7b9
MD5 hash:	aa3c1782b0e3a60b0fad4bc89c165615
humanhash:	johnny-uncle-sink-mango
File name:	6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb.bin.exe
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	1'996'288 bytes
First seen:	2025-10-28 06:57:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep	24576:w2BY+F7V0kFO5Zo5yWK3NBbIlopMXPTtdIQqcy0YEMcM4B4PacqZ4gctpMOr3Lz3:wha6kZzK3klckPhy6McMs4Sd2nj
TLSH	T1869533675EE0A9F9E1C2473A9FBF89C719423A38054A5CD9B70E006C5D3B34129BE4E3
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	abuse_ch
Tags:	exe Rhadamanthys

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

81

Origin country :

SE

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb.bin.exe

Verdict:

No threats detected

Analysis date:

2025-10-27 00:16:09 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/d19c2c6c-d29b-4ad1-93e0-1d47638b7f29

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/34386/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Lumma-1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=690069b45de5ca2707532692

Tags:

virus

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for analyzing tools

Creating a window

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

amadey anti-vm anti-vm crypt evasive fingerprint lumma masquerade microsoft_visual_cc obfuscated overlay overlay packed packed stealer themidawinlicense unsafe zero

Link:

https://www.filescan.io/uploads/6900698f3a79800405fa296b/reports/902d3c68-3755-4195-875e-d63b085f586e/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-10-26T21:20:00Z UTC

Last seen:

2025-10-27T00:23:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.Strab.sb HEUR:Trojan-PSW.Win32.Predator.gen HEUR:Trojan-PSW.Win32.Lumma.pef Trojan-PSW.Win32.Rhadamanthys.sb

Link:

https://opentip.kaspersky.com/6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb/results?tab=lookup

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/82c125cb-810c-4575-9b5b-e9f17998a126

Joe Sandbox RHADAMANTHYS

Result

Threat name:

RHADAMANTHYS

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1802929

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Hides threads from debuggers

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/aa3c1782b0e3a60b0fad4bc89c165615

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb/

Neiki Trojan-PSW.Win32.Lumma

Verdict:

Malicious

Threat:

Trojan-PSW.Win32.Lumma

Link:

https://tip.neiki.dev/file/6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb

ReversingLabs TitaniumCloud Win32.Malware.Heuristic

Threat name:

Win32.Malware.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-27 00:04:52 UTC

File Type:

PE (Exe)

Extracted files:

1

AV detection:

21 of 24 (87.50%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n2t35ga5fayicpskgcw6jooyrerpaaqcnd4i4czqta3rolenkd5q._file

Threatray rhadamanthys

Verdict:

malicious

Label(s):

rhadamanthys

Alert

Create hunting rule

Similar samples:

error

Rhadamanthys

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/251028-hrw5davpcy/

Behaviour

Suspicious behavior: EnumeratesProcesses

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks BIOS information in registry

Identifies Wine through registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/dea57bb5-5158-49bd-99a4-919c220adcca

UnpacMe 2

Unpacked files

SH256 hash:

6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb

MD5 hash:

aa3c1782b0e3a60b0fad4bc89c165615

SHA1 hash:

2986fd9d86d80ff9671052073c18eff61131f7b9

Link:

https://www.unpac.me/results/ef30d4bf-c70d-4f89-a923-644464ecadb5/

SH256 hash:

914c50fb698c2a2e007ba8a5419e1352efb295f5eeac0bcbf29d90f386040dfc

MD5 hash:

94e69a771690d576d22d833c2982dc02

SHA1 hash:

0a09ce46df124f50804b09b7ab644b373554f440

Link:

https://www.unpac.me/results/ef30d4bf-c70d-4f89-a923-644464ecadb5/

VMRay Rhadamanthys

Malware family:

Rhadamanthys

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6ea7be981d28/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

exe 6ea7be981d2830813e4a30ade4b9d88922f0020268f88e0b309837172c8d50fb

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/3687751/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/34386/