MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c3df25808e764c61d9db2d4021d2e8d2f266b710bed35ce91e7384ded271faf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 13


Intelligence 13 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c3df25808e764c61d9db2d4021d2e8d2f266b710bed35ce91e7384ded271faf
SHA3-384 hash: c99a0ed9325b9aa9d59bf5e8d9f05a42e4adcd0fec3ac4d1367a0689f6511fa5acd22e905e0867a69bbf7528faba3081
SHA1 hash: b50bd3ac746f0fad9d4f434a9c02c8eefa1b9a89
MD5 hash: d0ede6e4fb73b98bf043b4c222a4ac29
humanhash: oranges-harry-autumn-lima
File name:[x86][x64]_Setup_patched.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:3'753'984 bytes
First seen:2025-03-18 19:29:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7384584e673981d184ff0b4b6a3ffac7 (2 x Rhadamanthys)
ssdeep 98304:VKul8rLH4ymLqDrOZrTO5TupGSEmeCltU:0xPYymLqWOuzeUtU
Threatray 61 similar samples on MalwareBazaar
TLSH T18006D0127291C0B6D1530D7069ACAB6A95BDFE705B3189C3B3803E6C6971AC3E536E1F
TrID 68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.5% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon ba451b6579456549 (2 x Rhadamanthys, 1 x Formbook, 1 x CryptBot)
Reporter aachum
Tags:de-pumped exe Rhadamanthys


Avatar
iamaachum
https://a14v3gaz230724i.click/c95b77195990e107b327dde2086e23785f8a5dec/file-67d9c683b8cf8/?source=2791&grp=50&file=&q=After-Verification-Click---Go-To-Download-Page =>https://mega.nz/file/nVsxwICb#hQMi4P8NSU-VRc4xTOL4sZU6ecery84KVA80Uq7Y-eM/utm/10e6b15ee26c1481635

Intelligence

File Origin
# of uploads :
1
# of downloads :
447
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
[x86][x64]_Setup_patched.exe
Verdict:
Malicious activity
Analysis date:
2025-03-18 19:24:59 UTC
Tags:
rhadamanthys stealer
Link:
https://app.any.run/tasks/8e309b44-069a-42f1-933e-08d4d9744abe

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d9d464194f23322a70dd92
Tags:
downloader dropper virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Using the Windows Management Instrumentation requests
Connection attempt
Sending a custom TCP request
DNS request
Sending a UDP request
Reading critical registry keys
Creating a window
Unauthorized injection to a system process
Stealing user critical data
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/7c3df25808e764c61d9db2d4021d2e8d2f266b710bed35ce91e7384ded271faf
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/da76a34b-eb9e-4eb6-be3a-be79e7aba786
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1642087
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
67%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/7c3df25808e764c61d9db2d4021d2e8d2f266b710bed35ce91e7384ded271faf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7c3df25808e764c61d9db2d4021d2e8d2f266b710bed35ce91e7384ded271faf/
Threat name:
Win32.Exploit.Rhadamanthys
Create hunting rule
Status:
Malicious
First seen:
2025-03-18 19:29:15 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pq67ewai45smmhm5wlkaehjoruxsm23rbpwtltur444e33jhd6xq._file
Verdict:
malicious
Label(s):
rhadamanthys
Create hunting rule
Similar samples:
7c3df25808e764c61d9db2d4021d2e8d2f266b710bed35ce91e7384ded271faf
Rhadamanthys
82285aaafe378305cd523e4bb1ad93725ba51501c7dcfc68af15512017115b9a
Rhadamanthys
8651f126047222ca0273f9d0000681538a5847f7e4a45f62af497f934df014e1
Rhadamanthys
a88c153e1595f9d193b3f881ec77e0d7d338ae22c9f6e67ffdf39c3609fcdbf7
Rhadamanthys
b537b24d31cd6cf9809827248309a7710461831149b695cacea56fa7f9b49d79
Rhadamanthys
dabfe2b02c36b5f1a7f1c0d96798c944f69f84c4889e2e7e25655bb4d3894f31
Rhadamanthys
e2f944cbcda22e6fd727f93514d11a7885f4bae6c6c5f33630e737b7c861907e
Rhadamanthys
ec7bee464dfecee9727881acf530a1b649be2036b716f0859910f938f2e577dd
Rhadamanthys
error
Rhadamanthys
+ 51 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery
Link:
https://tria.ge/reports/250318-x7acwaw1ey/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of NtCreateUserProcessOtherParentProcess
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6d083565-2065-4a85-991e-4abe8e6c3316
Unpacked files
SH256 hash:
7c3df25808e764c61d9db2d4021d2e8d2f266b710bed35ce91e7384ded271faf
MD5 hash:
d0ede6e4fb73b98bf043b4c222a4ac29
SHA1 hash:
b50bd3ac746f0fad9d4f434a9c02c8eefa1b9a89
Link:
https://www.unpac.me/results/ebf9a404-e895-49cb-a5e8-892a3e3e7d33/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7c3df25808e7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7c3df25808e764c61d9db2d4021d2e8d2f266b710bed35ce91e7384ded271faf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_RMM_AeroAdmin
Create hunting rule
Author:ditekSHen
Description:Detects AeroAdmin. Review RMM Inventory
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

7z 2c5a74fdffdce61b603d02022c932b36204fdc8db9ef69b46f39d5404a4c2312

Rhadamanthys

Executable exe 7c3df25808e764c61d9db2d4021d2e8d2f266b710bed35ce91e7384ded271faf

(this sample)

anyrun
any.run
https://app.any.run/tasks/8e309b44-069a-42f1-933e-08d4d9744abe
  
Dropped by
SHA256 2c5a74fdffdce61b603d02022c932b36204fdc8db9ef69b46f39d5404a4c2312
  
Delivery method
Distributed via web download
  
Dropped by
MD5 f9a15a0ca1aad9af4768c8cef74cb820

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::FreeSid
ADVAPI32.dll::SetEntriesInAclW
ADVAPI32.dll::SetSecurityInfo
ADVAPI32.dll::SetTokenInformation
ADVAPI32.dll::InitializeSecurityDescriptor
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
GDI_PLUS_APIInterfaces with Graphicsgdiplus.dll::GdiplusStartup
gdiplus.dll::GdiplusShutdown
gdiplus.dll::GdipGetImageEncodersSize
gdiplus.dll::GdipGetImageEncoders
gdiplus.dll::GdipAlloc
MULTIMEDIA_APICan Play MultimediaWINMM.dll::timeBeginPeriod
WINMM.dll::timeEndPeriod
WINMM.dll::waveInAddBuffer
WINMM.dll::waveInClose
WINMM.dll::waveInGetDevCapsW
WINMM.dll::waveInGetNumDevs
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::SetFileSecurityW
ADVAPI32.dll::SetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteW
SHELL32.dll::ShellExecuteExW
SHELL32.dll::SHGetFileInfoW
URL_MONIKERS_APICan Download & Execute componentsurlmon.dll::URLDownloadToFileW
urlmon.dll::URLOpenBlockingStreamW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
WINHTTP.dll::WinHttpCloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetVolumeInformationW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetDiskFreeSpaceExW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AttachConsole
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
IPHLPAPI.DLL::IcmpCreateFile
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::LogonUserW
ADVAPI32.dll::LookupAccountSidW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_CRYPT_APIUses Windows Crypt APICRYPT32.dll::CertGetCertificateContextProperty
ADVAPI32.dll::CryptAcquireContextW
ADVAPI32.dll::CryptGenRandom
WIN_HTTP_APIUses HTTP servicesWINHTTP.dll::WinHttpAddRequestHeaders
WINHTTP.dll::WinHttpConnect
WINHTTP.dll::WinHttpOpen
WINHTTP.dll::WinHttpOpenRequest
WINHTTP.dll::WinHttpQueryDataAvailable
WINHTTP.dll::WinHttpQueryOption
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetEnumResourceW
MPR.dll::WNetOpenEnumW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_SOCK_APIUses Network to send and receive dataWS2_32.dll::freeaddrinfo
WS2_32.dll::getaddrinfo
WS2_32.dll::WSAConnect
WS2_32.dll::WSASocketW
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::ChangeServiceConfig2W
ADVAPI32.dll::CreateServiceW
ADVAPI32.dll::OpenSCManagerW
ADVAPI32.dll::OpenServiceW
ADVAPI32.dll::RegisterServiceCtrlHandlerExW
ADVAPI32.dll::StartServiceW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::BroadcastSystemMessageW
USER32.dll::CloseDesktop
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowW
USER32.dll::LockWorkStation

Comments