MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf7469f8d7e837770a7d7a9e126cd1c718d5c55598b964dddd3be20596d1535a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 6

Intelligence 6 IOCs YARA 12 File information Comments

SHA256 hash:	cf7469f8d7e837770a7d7a9e126cd1c718d5c55598b964dddd3be20596d1535a
SHA3-384 hash:	a26a96b347f3776fec0f915ebba4976dab952de54d971ee49ea1c693c8f8b0e202ffaff0c496724502d67a24d39e734a
SHA1 hash:	cb388a5b29d657aabf32cc4ab7bc12cae4fa31fe
MD5 hash:	4dbfdb286b684d0d1b8065dee6cb6051
humanhash:	golf-xray-sierra-freddie
File name:	LAUNCHER_v3.13.zip
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	3'955'780 bytes
First seen:	2025-02-02 14:21:52 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	98304:r7Kyq7UD2VxBAVAEQMqXA1L56X7gjz9V2l6W:Nc+2Vxy2Eb4M96Ejz9V2l6W
TLSH	T111061267A4A71F90C8AC61BAC1DB1B06272DBB5B0116D72F8324E22F7FF66F4C954442
Magika	zip
Reporter	aachum
Tags:	file-pumped rezipped Rhadamanthys zip

iamaachum

https://ailzszhds.cfd/?v1ichH54P8YxoMmQWnLX2TkDzJuUj7qO=9pEXT8aFrMWgGDB4LHv7edY1VCsi3hNJmtIRzPfl6kuQycj=qhGon7Z2Mxmdl5yNUHzID4Tvkp19ujS8gfAJieVQPwW#oRiQXfJuvVSxs2GD9691F0pPXtRJFgn9XlgFxvxcEUPckZqePuo => https://mega.nz/file/EL9XCYgI#UTKlOfSaIRV03hC3jVnPTvPfTI6m4B53ZonRtXKchq0

Intelligence

File Origin

# of uploads :

# of downloads :

242

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	LAUNCHER_v3.13.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	865'078'262 bytes
SHA256 hash:	2c5d8f638a7b23c71da4145093db64d1df68f5f2713b10efd8a7cc6ae7f883cc
MD5 hash:	37908fd0cc14a85d8b6c51ea00bd3fa9
De-pumped file size:	4'167'168 bytes (Vs. original size of 865'078'262 bytes)
De-pumped SHA256 hash:	9fe86d6c49079c5c47955ea7b2c04a1b9e16340b88799fc02bceaee4e4f3e99e
De-pumped MD5 hash:	06f5efcc79a2ffb6a241024336c1be94
MIME type:	application/x-dosexec
Signature	Adware.Generic

Vendor Threat Intelligence

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=679f7fa8416a81ccc3c50030

Tags:

n/a

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/cf7469f8d7e837770a7d7a9e126cd1c718d5c55598b964dddd3be20596d1535a/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

Gathering data

Verdict:

Suspicious

Labled as:

HEUR/Pumpar.Generic

Link:

https://www.hybrid-analysis.com/sample/cf7469f8d7e837770a7d7a9e126cd1c718d5c55598b964dddd3be20596d1535a

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/cf7469f8d7e837770a7d7a9e126cd1c718d5c55598b964dddd3be20596d1535a

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250202-rw1g2axqdq/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cf7469f8d7e837770a7d7a9e126cd1c718d5c55598b964dddd3be20596d1535a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PK_PUMP_AND_DUMP Create hunting rule
Author:	Will Metcalf @node5
Description:	Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Suspicious_Latam_MSI_and_ZIP_Files Create hunting rule
Author:	eremit4, P4nd3m1cb0y
Description:	Detects suspicious .msi and .zip files used in Latam banking trojan campaigns.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	weird_zip_high_compression_ratio Create hunting rule
Author:	Maxime THIEBAUT (@0xThiebaut)
Description:	Detects single-entry ZIP files with a suspiciously high compression ratio (>100:1) and decompressed size above the 500MB AV limit
Reference:	https://twitter.com/Cryptolaemus1/status/1633099154623803394