MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9870a4c2767b81392b1ab58c799a73532a1276d2c7a8b7115bce13116b44482c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9870a4c2767b81392b1ab58c799a73532a1276d2c7a8b7115bce13116b44482c
SHA3-384 hash:	c74acdfe56b26a6bcc48978bf8437025d6619042a96386a4d071abeab60b83ed5d51f76d177f81d1995f03ca133756a0
SHA1 hash:	2df220045f0c53349f9dcb4840e847288ac2a9ab
MD5 hash:	6c7b1e2f5aad2c4692e68d51d9c82d97
humanhash:	eight-snake-golf-tennis
File name:	random.exe
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	1'992'704 bytes
First seen:	2025-10-29 16:18:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep	49152:yha6k6QGNqlt5bsWHhO+dhOMIsTkfi3WhT/IpGgRBBXlaO:EaP6tSzbsGhO+dhO/sYfiLG4BBXg
TLSH	T1A89533051F380FADFBD5A23ACDB506912FB8DD2B6C259DD6321854F0FA665B206C2C93
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	abuse_ch
Tags:	exe Rhadamanthys

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

SE

Vendor Threat Intelligence

ANY.RUN

Malware family:

n/a

ID:

1

File name:

9870a4c2767b81392b1ab58c799a73532a1276d2c7a8b7115bce13116b44482c.bin.exe

Verdict:

No threats detected

Analysis date:

2025-10-29 17:01:27 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e3e3e9ab-cd86-427d-b4de-03667c5a2e6d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/34662/

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69023f6d706befaf4eca0a91

Tags:

obfusc crypt virus

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for analyzing tools

Creating a window

Launching a process

Using the Windows Management Instrumentation requests

Launching the default Windows debugger (dwwin.exe)

DNS request

Connection attempt

Sending a custom TCP request

Unauthorized injection to a system process

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

microsoft_visual_cc obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/69026bf8be20d9334859b804/reports/42f16283-b203-4897-b68f-85e60603e7cd/overview

Hybrid Analysis Jaik.Generic

Verdict:

Malicious

Labled as:

Jaik.Generic

Link:

https://www.hybrid-analysis.com/sample/9870a4c2767b81392b1ab58c799a73532a1276d2c7a8b7115bce13116b44482c

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-10-28T16:03:00Z UTC

Last seen:

2025-10-28T19:55:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9870a4c2767b81392b1ab58c799a73532a1276d2c7a8b7115bce13116b44482c/results?tab=lookup

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/16002909-c6ee-4d3c-a390-76f91b84cefc

Joe Sandbox RHADAMANTHYS

Result

Threat name:

RHADAMANTHYS

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1804217

Signature

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Hides threads from debuggers

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/9870a4c2767b81392b1ab58c799a73532a1276d2c7a8b7115bce13116b44482c

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/6c7b1e2f5aad2c4692e68d51d9c82d97

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9870a4c2767b81392b1ab58c799a73532a1276d2c7a8b7115bce13116b44482c/

Neiki Win32.Malware.Heuristic

Verdict:

Malicious

Threat:

Win32.Malware.Heuristic

Link:

https://tip.neiki.dev/file/9870a4c2767b81392b1ab58c799a73532a1276d2c7a8b7115bce13116b44482c

ReversingLabs TitaniumCloud Win32.Trojan.Amadey

Threat name:

Win32.Trojan.Amadey

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-29 09:21:21 UTC

File Type:

PE (Exe)

Extracted files:

1

AV detection:

30 of 38 (78.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tbykjqtwpoatsky2wwghtgttkmvbe5wsy6uloek3zyjrc22ejawa._file

Threatray rhadamanthys

Verdict:

malicious

Label(s):

rhadamanthys

Alert

Create hunting rule

Similar samples:

error

Rhadamanthys

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/251029-x2ncjssqh1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks BIOS information in registry

Identifies Wine through registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Suspicious use of NtCreateUserProcessOtherParentProcess

UnpacMe 2

Unpacked files

SH256 hash:

9870a4c2767b81392b1ab58c799a73532a1276d2c7a8b7115bce13116b44482c

MD5 hash:

6c7b1e2f5aad2c4692e68d51d9c82d97

SHA1 hash:

2df220045f0c53349f9dcb4840e847288ac2a9ab

Link:

https://www.unpac.me/results/1975642c-47da-4762-8a81-e9e211ac97dc/

SH256 hash:

db74a8a1d847a4102b8178f9e70b8046e75ef339cf43447c2cfbbd1af60a0957

MD5 hash:

53ea65020fc0f4b94240e5aed9f55c85

SHA1 hash:

aa8e514763fe83b79347fc95717e4df9ce775571

Link:

https://www.unpac.me/results/1975642c-47da-4762-8a81-e9e211ac97dc/

VMRay Rhadamanthys

Malware family:

Rhadamanthys

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9870a4c2767b/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9870a4c2767b81392b1ab58c799a73532a1276d2c7a8b7115bce13116b44482c

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

exe 9870a4c2767b81392b1ab58c799a73532a1276d2c7a8b7115bce13116b44482c

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/3687751/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/34662/