MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 875669294895d3a45b8a57de365a3ab92f2a2555d07471333e21fc0c7b49ecb5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	875669294895d3a45b8a57de365a3ab92f2a2555d07471333e21fc0c7b49ecb5
SHA3-384 hash:	80fce2c1d8eb262da77da3a7ef10ab89d5666cba7822a68657ef94ec6d44adfc5e3babe401029d5d6bc9abc32f5d8341
SHA1 hash:	057fe867eef771edcab59ac9eaf7280e99dc013e
MD5 hash:	50eedefe9c740f2672f052e0f0a396c2
humanhash:	eight-quiet-moon-mars
File name:	file.7z
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	14'254'995 bytes
First seen:	2025-10-11 10:10:34 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
Note:	This file is a password protected archive. The password is: 5202
ssdeep	393216:RoKEG/JCkbwGotY7sdp4esNs7fYAhs3OSuVti9/w:eGxB8cQ6NIvyIti9Y
TLSH	T1CEE6337CBCD9D4CDD02E6D47D7ED6285A9DA70F82CB966E820F0E19068DEDC38B96104
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	aachum
Tags:	37-221-66-137 7z AutoIT CypherIT file-pumped pw-5202 Rhadamanthys

iamaachum

https://media.mydrive112.lat/file.zip => https://arch.mydrive112.lat/request/media/[redacted]/file.zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file is a password protected archive. The password is: 5202

This file archive contains 1 file(s), sorted by their relevance:

File name:	file.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	906'706'294 bytes
SHA256 hash:	4ee970a2a35632bd2acd64d8a6d4052c1a30cae7c6510837050e8414df020c70
MD5 hash:	c0f0a4ab0cb0dfecd8641d3c91e4d6bd
De-pumped file size:	1'783'808 bytes (Vs. original size of 906'706'294 bytes)
De-pumped SHA256 hash:	a2844371d9b0742c1e2b1089e4e63243296d447af7186a30e82b3c3a5a32d104
De-pumped MD5 hash:	af1e49b40bada9430ff0805087795221
MIME type:	application/x-dosexec
Signature	Rhadamanthys

Vendor Threat Intelligence

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68ea2d30f2ca2f143e414800

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/875669294895d3a45b8a57de365a3ab92f2a2555d07471333e21fc0c7b49ecb5

Verdict:

Unknown

File Type:

Link:

https://opentip.kaspersky.com/875669294895d3a45b8a57de365a3ab92f2a2555d07471333e21fc0c7b49ecb5/results?tab=lookup

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

7z Archive SFX 7z

Link:

https://app.malva.re/file/50eedefe9c740f2672f052e0f0a396c2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/875669294895d3a45b8a57de365a3ab92f2a2555d07471333e21fc0c7b49ecb5/

Threat name:

Binary.Trojan.Generic

Status:

Suspicious

First seen:

2025-10-11 10:12:41 UTC

File Type:

Binary (Archive)

AV detection:

3 of 24 (12.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=q5lgskkisxj2iw4kk7pdmwr2xexsujkv2b2hcmz6eh6ay62j5s2q._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/875669294895d3a45b8a57de365a3ab92f2a2555d07471333e21fc0c7b49ecb5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.