MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b58e702a1342357301a12d8b71421cb5d7b05f7709ea3f99fe87a04383336b07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b58e702a1342357301a12d8b71421cb5d7b05f7709ea3f99fe87a04383336b07
SHA3-384 hash:	159f6eb77a971a05a3fa0f4075f17c4e16376c715f3464abc09c93f39d1d6d2093f456cd4b3afc63807bfc9fc341c844
SHA1 hash:	7c036ee13c244fef8254d54e94804d7248d538ef
MD5 hash:	f2e42b8c9cd4cf8f7499a19c9fe11c40
humanhash:	lamp-nineteen-artist-fish
File name:	random.exe
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	1'966'080 bytes
First seen:	2025-10-29 16:20:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep	49152:Uha6kdiWM/tMT7yk+7BYXfqyfJEkgacuRxpoP+:SaPcWMe+72XfqyPgacuHpj
Threatray	1 similar samples on MalwareBazaar
TLSH	T10D95332A4CF6D03ED7C265799AF756DA7D2CFB2C00E714697508C6AC6E72E012BE4063
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	abuse_ch
Tags:	exe Rhadamanthys

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

98

Origin country :

SE

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

random.exe

Verdict:

Malicious activity

Analysis date:

2025-10-29 17:04:57 UTC

Tags:

rhadamanthys stealer shellcode

Link:

https://app.any.run/tasks/01617ff3-aab2-4e76-a3a5-12922725c009

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox Rhadamanthys

Detection:

Rhadamanthys

Alert

Create hunting rule

Link:

https://www.capesandbox.com/analysis/34675/

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=690240609942f1282eca2e0e

Tags:

malware

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for analyzing tools

Creating a window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending a custom TCP request

Unauthorized injection to a system process

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

microsoft_visual_cc obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/69026cda21d55ed90d421899/reports/0bfe7d00-9e15-435d-ae27-d5935608988a/overview

Hybrid Analysis Symmi.Generic

Verdict:

Malicious

Labled as:

Symmi.Generic

Link:

https://www.hybrid-analysis.com/sample/b58e702a1342357301a12d8b71421cb5d7b05f7709ea3f99fe87a04383336b07

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-10-29T04:04:00Z UTC

Last seen:

2025-10-29T05:25:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b58e702a1342357301a12d8b71421cb5d7b05f7709ea3f99fe87a04383336b07/results?tab=lookup

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/a7bb2366-aaf2-46fc-af21-9301cc47a6b8

Joe Sandbox RHADAMANTHYS

Result

Threat name:

RHADAMANTHYS

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1804158

Signature

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Hides threads from debuggers

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Potentially malicious time measurement code found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/b58e702a1342357301a12d8b71421cb5d7b05f7709ea3f99fe87a04383336b07

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/f2e42b8c9cd4cf8f7499a19c9fe11c40

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b58e702a1342357301a12d8b71421cb5d7b05f7709ea3f99fe87a04383336b07/

Neiki Family.RHADAMANTHYS

Verdict:

Malicious

Threat:

Family.RHADAMANTHYS

Link:

https://tip.neiki.dev/file/b58e702a1342357301a12d8b71421cb5d7b05f7709ea3f99fe87a04383336b07

ReversingLabs TitaniumCloud Win32.Trojan.Amadey

Threat name:

Win32.Trojan.Amadey

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-29 08:59:47 UTC

File Type:

PE (Exe)

Extracted files:

1

AV detection:

31 of 37 (83.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wwhhakqtii2xganbfwfxcqq4wxl3ax3xbhvd7gp6q6qehaztnmdq._file

Threatray rhadamanthys

Verdict:

malicious

Label(s):

rhadamanthys

Alert

Create hunting rule

Similar samples:

b58e702a1342357301a12d8b71421cb5d7b05f7709ea3f99fe87a04383336b07

Rhadamanthys

error

Rhadamanthys

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/251029-x4qwfsbn6t/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks BIOS information in registry

Identifies Wine through registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Suspicious use of NtCreateUserProcessOtherParentProcess

UnpacMe 2

Unpacked files

SH256 hash:

b58e702a1342357301a12d8b71421cb5d7b05f7709ea3f99fe87a04383336b07

MD5 hash:

f2e42b8c9cd4cf8f7499a19c9fe11c40

SHA1 hash:

7c036ee13c244fef8254d54e94804d7248d538ef

Link:

https://www.unpac.me/results/312da9f4-c35a-4f5c-993a-337451e8b333/

SH256 hash:

aee24d500e0fe38fbfbc816dd0202205e5abf28f36a710d366df0d1e189cbdc4

MD5 hash:

71826fd9279611f844a367ad56763ae1

SHA1 hash:

0846a862c0da5ae0844b4e332fbc78737c590bea

Link:

https://www.unpac.me/results/312da9f4-c35a-4f5c-993a-337451e8b333/

VMRay Rhadamanthys

Malware family:

Rhadamanthys

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b58e702a1342/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b58e702a1342357301a12d8b71421cb5d7b05f7709ea3f99fe87a04383336b07

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

exe b58e702a1342357301a12d8b71421cb5d7b05f7709ea3f99fe87a04383336b07

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/3687751/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/34675/