MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 960bcb3ec7258abbdacbef2a7f6749f6a47fa5184152402771add6a4c7b51725. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 960bcb3ec7258abbdacbef2a7f6749f6a47fa5184152402771add6a4c7b51725
SHA3-384 hash: 81a7734a475de78b012851dbd07f1650914e45bca484f6286392a82e5388e228e87b3b481642c9f96dd37a176f58f4fc
SHA1 hash: d8fa02e3ec2da4573fa5d64d6a91d7f5d545c2a8
MD5 hash: 38f9c7b4d32337edff4426234cd69ec7
humanhash: robin-kitten-batman-video
File name:SecuriteInfo.com.Trojan.InjectNET.84.2895.12500
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:1'357'312 bytes
First seen:2025-10-28 07:16:51 UTC
Last seen:2025-10-28 08:45:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:FC7lquuNg18NEEa3Q2tJ1/5zRX77/3YBRNEiHNDTdcxsYYcRt2gdvU5dH:FC7ug15lrB/38LURtRvU
Threatray 453 similar samples on MalwareBazaar
TLSH T1FA55302C26FA4349F273AE364AD9B5958A1F76E2E5F6538B134C020B4711680CF91FF6
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10522/11/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
2
# of downloads :
68
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.InjectNET.84.2895.12500
Verdict:
Malicious activity
Analysis date:
2025-10-28 07:37:26 UTC
Tags:
rhadamanthys stealer
Link:
https://app.any.run/tasks/7ac756d8-2ef1-47da-8e28-4afc4966df1c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/34402/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69006e535c3edf10df5319d8
Tags:
virus micro msil
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Connection attempt to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint obfuscated packed packed packer_detected threat
Link:
https://www.filescan.io/uploads/69006eb8c85c5c56973879e9/reports/01f1135a-3a8d-44c2-959a-e0cc83d5a7b6/overview
Verdict:
Malicious
Labled as:
IL:Trojan.MSILZilla
Link:
https://www.hybrid-analysis.com/sample/960bcb3ec7258abbdacbef2a7f6749f6a47fa5184152402771add6a4c7b51725
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-27T19:46:00Z UTC
Last seen:
2025-10-29T03:04:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/960bcb3ec7258abbdacbef2a7f6749f6a47fa5184152402771add6a4c7b51725/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/30b00f1e-7ee3-4860-8458-5cc29ede7e64
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/960bcb3ec7258abbdacbef2a7f6749f6a47fa5184152402771add6a4c7b51725
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.23 Win 32 Exe x86
Link:
https://app.malva.re/file/38f9c7b4d32337edff4426234cd69ec7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/960bcb3ec7258abbdacbef2a7f6749f6a47fa5184152402771add6a4c7b51725/
Threat name:
ByteCode-MSIL.Trojan.Zilla
Create hunting rule
Status:
Malicious
First seen:
2025-10-27 22:19:41 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=syf4wpwhewflxwwl54vh6z2j62sh7jiyifjeaj3rvxlkjr5vc4sq._file
Verdict:
malicious
Label(s):
rhadamanthys
Create hunting rule
Similar samples:
36eeed998c47e1eadbd363a269e778dc1c0bd21c192180de220af130d59d74fe
Rhadamanthys
4f163bfa3869ae475b639f1c2caf40828331ca2e6c4a8b30750e5f4a0c164c10
Rhadamanthys
5454c752972ea61fa619b6b687597e86f54ed685b92f1e5beadf65791adbe130
Rhadamanthys
667042d2b9e6a7ce756504339331b15b9810dcbc22eab743fb435110669452ce
Rhadamanthys
6e64eb97cc46d6791a9d9d80d42ecabb57f2a6fdecf972db4801333baf55afa2
Rhadamanthys
981f6c1aeacdcf274d0a04c717ca6632022f8314bd853774fea72953f7b3b526
Rhadamanthys
bbb0b744632fe251819233d4c693758a4e8d20b3b88f5605a60aaebb4ae1ed9d
Rhadamanthys
cf101e60653e1a1af54335d9efb4e2942d32b8b8b1be729166ce528b0991e3f2
Rhadamanthys
d378eafd2f24af93bfd44936867aa85d2b78434b7fd04960f7ed696f337b4389
Rhadamanthys
d813b9c2a13e3e2d7423a2496a8d7397df8135cf0376d1fad06cb3af794a651e
Rhadamanthys
error
Rhadamanthys
+ 443 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251028-h6ajxssqfr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/ee3aa5a5-906b-482c-8d95-3159ad91ef2e
Unpacked files
SH256 hash:
960bcb3ec7258abbdacbef2a7f6749f6a47fa5184152402771add6a4c7b51725
MD5 hash:
38f9c7b4d32337edff4426234cd69ec7
SHA1 hash:
d8fa02e3ec2da4573fa5d64d6a91d7f5d545c2a8
Link:
https://www.unpac.me/results/4db1c1b4-d9a5-4a6d-89e3-d30a364b557b/
Malware family:
Rhadamanthys
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/960bcb3ec725/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

Executable exe 960bcb3ec7258abbdacbef2a7f6749f6a47fa5184152402771add6a4c7b51725

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3689346/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/34402/

Comments