MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 13

Intelligence 13 IOCs YARA 37 File information Comments

SHA256 hash:	7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad
SHA3-384 hash:	95c84ec729447d8d9922e9e440b97e000acffd2c2b419e066c57c7de02dd24e3b354840e8e5ad78de95b1282aa5e7cb8
SHA1 hash:	87596edc57173f151068404152eb50212c768c96
MD5 hash:	73c940e6cb2ff49f8e8c145524c41fd8
humanhash:	hawaii-network-fanta-fish
File name:	7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	32'276'994 bytes
First seen:	2026-09-29 10:57:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4cea7ae85c87ddc7295d39ff9cda31d1 (103 x LummaStealer, 85 x RedLineStealer, 63 x Rhadamanthys)
ssdeep	393216:mGj2tSGEmBxcjiY9tkVVM59BxQysQYV1XMh1TGqwoC:mGSyiYAVVMHqHPXW
TLSH	T195678C20B7984075D9EB1234146F6726A27FFD505BB086CF6650A39EAC317C2AF313A7
TrID	62.6% (.AX) DirectShow filter (201555/2/20) 12.9% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 9.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 5.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 2.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Magika	pebin
dhash icon	f1d1f1f9d1d119a5 (1 x Rhadamanthys)
Reporter	Anonymous
Tags:	exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

193

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/049b693b-42a2-467c-98db-f40a2395ef80/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-09-29 11:10:44 UTC

Tags:

autoit aura stealer generic evasion rhadamanthys

Link:

https://app.any.run/tasks/1d27bd0a-dca5-4c02-96ce-bcb93174115f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Launching a process

Creating a process with a hidden window

Running batch commands

Moving a file to the %temp% subdirectory

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Creating a window

Creating a process from a recently created file

Deleting a recently created file

DNS request

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

adaptive-context anti-vm CAB crypto hacktool installer installer installer-heuristic lolbin microsoft_visual_cc overlay packed packed reconnaissance rundll32 runonce

Link:

https://www.filescan.io/uploads/6abb99c7cc7be66c9f0ef7bc/reports/02b134f1-9e24-483f-bfb0-fa111301e208/overview

Verdict:

Malicious

Labled as:

LummaStealer.Generic

Link:

https://www.hybrid-analysis.com/sample/7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-10-28T12:34:00Z UTC

Last seen:

2026-09-30T18:16:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad/results?tab=lookup

Score:

47%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad

Gathering data

Threat name:

Win64.Trojan.LummaStealer

Status:

Malicious

First seen:

2025-10-28 20:13:47 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=psqbcayl3ok5bpcazda52ww2ggo7hbtzwpruhqgid437ef27wgwq._file

Verdict:

malicious

Label(s):

Rhadamanthys

Link:

https://reports.threatray.com/918e517b-480e-4d53-8281-99fc18eee9bd

Result

Malware family:

n/a

Score:

10/10

Tags:

defense_evasion discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/260929-m2x7msyyez/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

Discovers running processes

Suspicious use of SetThreadContext

Adds Run key to start application

Executes a file named after a Windows system binary

Executes dropped EXE

Suspicious use of NtCreateUserProcessOtherParentProcess

Malware family:

Rhadamanthys

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7ca011030bdb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7ca011030bdb95d0bc40c8c1dd5ada319df38679b3e343c0c81f37f2175fb1ad

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	detect_Redline_Stealer Create hunting rule
Author:	Varp0s

Rule name:	dgaagas Create hunting rule
Author:	Harshit
Description:	Uses certutil.exe to download a file named test.txt

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender Create hunting rule
Author:	ditekSHen
Description:	Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Rule name:	Jupyter_infostealer Create hunting rule
Author:	CD_R0M_
Description:	Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022

Rule name:	Mimikatz_Generic Create hunting rule
Author:	Still
Description:	attempts to match all variants of Mimikatz

Rule name:	MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects AgentTesla (inconnu, etat extrait)

Rule name:	Multi_WD_Strings_FullList_JS_stylesheet Create hunting rule
Author:	David Ledbetter @Ledtech3
Description:	This rule detects Multiple use of wd properties like the strings it also detects the embeded stylesheet with the URL's

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETDLLMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Rule_XL_Strings_FullList_JS Create hunting rule
Author:	David Ledbetter @Ledtech3
Description:	This rule detects Multiple use of wd properties like the strings it also detects the embeded stylesheet with the URL's

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Suspicious_PowerShell_Commands_Executed_via_Rundll32 Create hunting rule
Author:	assistant
Description:	Detects when rundll32.exe is used to execute PowerShell commands that may indicate malicious activity
Reference:	https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/win_susp_powershell_via_rundll32.yml

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	Sus_All_Windows_PE_Malware Create hunting rule
Author:	DiegoAnalytics
Description:	Detects Windows PE malware of all types, avoids non-executables like .html

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	TH_APT_EquationGroup_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Equation Group (G0020) APT malware detection - covers EquationDrug, GrayFish, DoubleFantasy, TripleFantasy, Fanny, GROK, nls_933w HDD firmware module, and Shadow Brokers tooling
Reference:	https://cyfare.net/

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	Wimmie Create hunting rule
Author:	Seth Hardy
Description:	Wimmie family

Rule name:	WimmieStrings Create hunting rule
Author:	Seth Hardy
Description:	Strings used by Wimmie

Rule name:	Win_Clipboard_Clipper_Thengavar Create hunting rule
Author:	Thengavar
Description:	Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

Rule name:	Win_FakeInstaller_PythonShellcodeLoader_Crepectl_2026 Create hunting rule
Author:	SixHands
Description:	Detects the analyzed fake installer sample using .key config, XOR key, and Python/fiber shellcode loader traits

Rule name:	WIN_Sample_Unique_69354b41 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample