MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c90ace3f5d60fdfbbe2c09e9cf5f84f1e89ef14ce022e7c418b243157328e8d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 15


Intelligence 15 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c90ace3f5d60fdfbbe2c09e9cf5f84f1e89ef14ce022e7c418b243157328e8d5
SHA3-384 hash: e9b7ec81636f7a6eb80303855fc3da6dc0ccf4342c5e5a488dc07aaf0e54bc630a021cd36b2b64899c9ee6608df1f938
SHA1 hash: 470ab4d6ac95c6bc5e9ac7047d8344d3dd3e8718
MD5 hash: 446dbbc59070e5d07185eb0e0b63a931
humanhash: arkansas-nebraska-colorado-nevada
File name:VortexWaveOrbitgridSyncSocket.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:14'223'695 bytes
First seen:2025-09-09 11:28:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b70a461a02eb0e102702c193236f5cdf (3 x Rhadamanthys)
ssdeep 12288:IR7mjU6OvAIMTCL3+Eb0F20dUVse4KhhaIkvaMF9/aWIfEIPAN9n+x7UsR:IR7mj7g0U0Usejhhh8jF9iWDTn+FUU
Threatray 481 similar samples on MalwareBazaar
TLSH T1C4E6E029FA8B53EDED1B283040B6B26F6AA12D41414CCC2DCF951FB17753B32A52B52D
TrID 37.3% (.EXE) Win64 Executable (generic) (10522/11/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.9% (.EXE) Win32 Executable (generic) (4504/4/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter SquiblydooBlog
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
VortexWaveOrbitgridSyncSocket.exe
Verdict:
Malicious activity
Analysis date:
2025-09-09 11:35:52 UTC
Tags:
anti-evasion stealer rhadamanthys evasion chstealer
Link:
https://app.any.run/tasks/84e6db3b-39fc-413a-94da-fdeb2d051d82

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Rhadamanthys
Create hunting rule
Link:
https://www.capesandbox.com/analysis/26457/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c00f6b6e66ba602d795a7d
Tags:
cobalt spoof
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Detecting VM
Launching a process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context microsoft_visual_cc obfuscated overlay packed packed packer_detected
Link:
https://www.filescan.io/uploads/68c00f92a1a41633174e698d/reports/476f424c-1357-4e99-ba69-e12585323d78/overview
Verdict:
Malicious
Labled as:
Babar.Generic
Link:
https://www.hybrid-analysis.com/sample/c90ace3f5d60fdfbbe2c09e9cf5f84f1e89ef14ce022e7c418b243157328e8d5
Verdict:
Unknown
File Type:
exe x32
Link:
https://opentip.kaspersky.com/c90ace3f5d60fdfbbe2c09e9cf5f84f1e89ef14ce022e7c418b243157328e8d5/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/f5ca995c-2396-4a17-a0c9-15a7d79099ab
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c90ace3f5d60fdfbbe2c09e9cf5f84f1e89ef14ce022e7c418b243157328e8d5
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/446dbbc59070e5d07185eb0e0b63a931
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c90ace3f5d60fdfbbe2c09e9cf5f84f1e89ef14ce022e7c418b243157328e8d5/
Threat name:
Win32.Spyware.Rhadamanthys
Create hunting rule
Status:
Malicious
First seen:
2025-09-03 03:28:19 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
26 of 38 (68.42%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zefm4p25md67xprmbhu46x4e6huj54km4aropraywjbrk4zi5dkq._file
Verdict:
malicious
Label(s):
rhadamanthys
Create hunting rule
Similar samples:
018f9ba428f4e3360bb6ee7c42f5f475bda12ae71a430d603a4a5e8ea94fdcf9
Rhadamanthys
155f53209e7e4aacf1efb3c929a2aaa659f98f9dd3ff703d0eed9ff7379a7da3
Rhadamanthys
1f51d10b1f8a2013c8f4c9a6b16a10154f0ad59402931e091add41f632f57290
Rhadamanthys
7908c78041ece2129127d26500321b09f094e41c66f535454884bb4d79573b9b
Rhadamanthys
a00f9b69f8250c86d0852c61a936f96372bd8c71fde6ddea492e3e2b8006ddea
Rhadamanthys
a451cbfe093830cd4d907d10bc0f27ea51da53ece5456af2fe6b3b24d3df163e
Rhadamanthys
b2f1ce3e05fade29dae205cac3685f78b97598deca3196b4676391cf84d86fe0
Rhadamanthys
d5d1a3362fe4e63bca40faa5c0a201a56c76cd27c1ce4c0b11a6bc13c3e19941
Rhadamanthys
error
Rhadamanthys
f5bc4cd08a3e95935a848c97c435a0fc41b3a118c45a5baf3e50e6e69a109aff
Rhadamanthys
+ 471 additional samples on MalwareBazaar
Result
Malware family:
rhadamanthys
Create hunting rule
Score:
  10/10
Tags:
family:rhadamanthys discovery stealer
Link:
https://tria.ge/reports/250909-nlsgws1py4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Program crash
System Location Discovery: System Language Discovery
Detects Rhadamanthys Payload
Rhadamanthys
Rhadamanthys family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/dc8f6396-d467-4744-a1cd-57744ab1566d
Unpacked files
SH256 hash:
c90ace3f5d60fdfbbe2c09e9cf5f84f1e89ef14ce022e7c418b243157328e8d5
MD5 hash:
446dbbc59070e5d07185eb0e0b63a931
SHA1 hash:
470ab4d6ac95c6bc5e9ac7047d8344d3dd3e8718
Link:
https://www.unpac.me/results/f5341fbd-11ce-416b-887f-f1baff36dbd5/
Malware family:
Rhadamanthys
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c90ace3f5d60/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c90ace3f5d60fdfbbe2c09e9cf5f84f1e89ef14ce022e7c418b243157328e8d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/26457/

Comments