MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97cb7eea0b37b9b754c6453bd82971c4c45885b939829cec75238d5566201155. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	97cb7eea0b37b9b754c6453bd82971c4c45885b939829cec75238d5566201155
SHA3-384 hash:	fc6deeb497b083fdf88af842ce4e26e5e3c33da20518c0866b0f9d1e971badf08b93304f684376acd55c4636f31c99af
SHA1 hash:	402ed9f64387b024669f652e8aac909e383a17ca
MD5 hash:	ae0d5688de17b23ac3cb832e4dbf982a
humanhash:	wyoming-oscar-johnny-mirror
File name:	random.exe
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	2'041'856 bytes
First seen:	2025-11-03 11:58:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep	24576:S2BY+F7V0kWr/tIrQfzXjBMLfM9OaP/ubwqXVe9nCKO5CN9iuYZoCRZVNIexUiVp:Sha6kQtZLj2xwqXYrxZ/CPVZuiVFK
TLSH	T1F895335A5EA5703EF3E50130693E44C73B152C3081A9EEF4A768E670BF479CC77A9892
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	abuse_ch
Tags:	exe Rhadamanthys

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

105

Origin country :

SE

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

random.exe

Verdict:

Malicious activity

Analysis date:

2025-11-03 11:58:43 UTC

Tags:

rhadamanthys stealer

Link:

https://app.any.run/tasks/91de576d-8004-47f0-9469-3a9620acc4e1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/35141/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Lumma-1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6908993a9942f1282ecba86f

Tags:

overt spawn crypt

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for analyzing tools

Creating a window

Launching a process

DNS request

Connection attempt

Launching the default Windows debugger (dwwin.exe)

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Unauthorized injection to a system process

FileScan.io

Gathering data

Hybrid Analysis Symmi.Generic

Verdict:

Malicious

Labled as:

Symmi.Generic

Link:

https://www.hybrid-analysis.com/sample/97cb7eea0b37b9b754c6453bd82971c4c45885b939829cec75238d5566201155

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-02T14:24:00Z UTC

Last seen:

2025-11-04T03:37:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-PSW.Win32.RisePro.gen HEUR:Trojan-PSW.Win32.Lumma.pef Trojan.Win64.SBEscape.sb Trojan.Win32.Inject.sb Trojan.Win32.Agent.sb Trojan.Win32.Strab.sb

Link:

https://opentip.kaspersky.com/97cb7eea0b37b9b754c6453bd82971c4c45885b939829cec75238d5566201155/results?tab=lookup

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/5d90b583-7ef8-40f4-8534-0343c598f3ee

Joe Sandbox RHADAMANTHYS

Result

Threat name:

RHADAMANTHYS

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1806886

Signature

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Hides threads from debuggers

PE file contains section with special chars

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/97cb7eea0b37b9b754c6453bd82971c4c45885b939829cec75238d5566201155

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/ae0d5688de17b23ac3cb832e4dbf982a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/97cb7eea0b37b9b754c6453bd82971c4c45885b939829cec75238d5566201155/

Neiki Family.RHADAMANTHYS

Verdict:

Malicious

Threat:

Family.RHADAMANTHYS

Link:

https://tip.neiki.dev/file/97cb7eea0b37b9b754c6453bd82971c4c45885b939829cec75238d5566201155

ReversingLabs TitaniumCloud Win32.Trojan.Symmi

Threat name:

Win32.Trojan.Symmi

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-03 09:12:34 UTC

File Type:

PE (Exe)

Extracted files:

1

AV detection:

31 of 38 (81.58%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s7fx52qlg643ovggiu55qklrytcfrbnzhgbjz3dveogvkzracfkq._file

Threatray rhadamanthys

Verdict:

malicious

Label(s):

rhadamanthys

Alert

Create hunting rule

Similar samples:

error

Rhadamanthys

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/251103-n8sfeazqfq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks BIOS information in registry

Identifies Wine through registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Suspicious use of NtCreateUserProcessOtherParentProcess

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/dd92f11e-9055-4547-a988-0bd0c31ecf75

UnpacMe 2

Unpacked files

SH256 hash:

97cb7eea0b37b9b754c6453bd82971c4c45885b939829cec75238d5566201155

MD5 hash:

ae0d5688de17b23ac3cb832e4dbf982a

SHA1 hash:

402ed9f64387b024669f652e8aac909e383a17ca

Link:

https://www.unpac.me/results/8866cd23-7b2e-4fcd-ae4f-e8c0fd828bc1/

SH256 hash:

624102adf54d06dad10dcdcfb785724229e736baee0faed397dc4255079d04a4

MD5 hash:

db4e7b23b266236fd7b282c6db2a64b8

SHA1 hash:

13f88c7a0d683fb23ea752720d25c2fbbdb07710

Link:

https://www.unpac.me/results/8866cd23-7b2e-4fcd-ae4f-e8c0fd828bc1/

VMRay Rhadamanthys

Malware family:

Rhadamanthys

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/97cb7eea0b37/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/97cb7eea0b37b9b754c6453bd82971c4c45885b939829cec75238d5566201155

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

exe 97cb7eea0b37b9b754c6453bd82971c4c45885b939829cec75238d5566201155

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/3687751/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/35141/