MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d01a48586072b4f2fc3182ba97f0e848b4d0b5642a12fc1180d614315d224a8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d01a48586072b4f2fc3182ba97f0e848b4d0b5642a12fc1180d614315d224a8c
SHA3-384 hash: 5dcdc3a1b474b18d3d8f430f6d07d4ab6a33e459bb0612f83d8e64be000c24892efbfa750448556c88f59c976fb68466
SHA1 hash: 3dda1c1aeb6602f240506e4fc19b58baae20a57f
MD5 hash: 3b234fc6df54cca76bb74e3ae052dc43
humanhash: missouri-delta-hydrogen-skylark
File name:Launcher.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:863'232 bytes
First seen:2025-10-14 10:46:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fe0fb677ca3eed35ee7b177f8baab8bd (4 x Rhadamanthys, 1 x MaskGramStealer)
ssdeep 12288:Q8yBELmWP+Gl1bn+1XNiF8wXujHVTZ47bEWQfVknWM6nhKdSRfieE3x0lhBpHWSr:QKf2DnZVN9WAVoWbAeEhMpHeP7C
Threatray 332 similar samples on MalwareBazaar
TLSH T17C05120573F580F3D6A7817589521A11B6327C119B206FEF43B0836BEF66AD0AD2FB25
TrID 63.5% (.EXE) Win64 Executable (generic) (10522/11/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter burger
Tags:exe Rhadamanthys

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Launcher.exe
Verdict:
Malicious activity
Analysis date:
2025-10-14 10:45:15 UTC
Tags:
anti-evasion lumma
Link:
https://app.any.run/tasks/052426f9-c9d5-4f46-891c-e8a1f009b721

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/32659/
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68ee2a0f97a16d00a8d9cf0e
Tags:
spoof overt virus crypt
Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/68ee2a4671883144ef3629db/reports/cfa175f0-7442-462d-b1e6-818f0a9207d0/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/d01a48586072b4f2fc3182ba97f0e848b4d0b5642a12fc1180d614315d224a8c
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-10-14T07:49:00Z UTC
Last seen:
2025-10-14T08:24:00Z UTC
Hits:
~10
Detections:
Trojan.Win64.SBEscape.sb Trojan.Win32.Crypt.sb Trojan.Win64.SBEscape.bew
Link:
https://opentip.kaspersky.com/d01a48586072b4f2fc3182ba97f0e848b4d0b5642a12fc1180d614315d224a8c/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d8f0e8ef-f1b6-4616-a14b-ed2189a4be1a
Result
Threat name:
RHADAMANTHYS
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1794708
Signature
Checks if the current machine is a virtual machine (disk enumeration)
Found direct / indirect Syscall (likely to bypass EDR)
Multi AV Scanner detection for submitted file
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected RHADAMANTHYS Stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d01a48586072b4f2fc3182ba97f0e848b4d0b5642a12fc1180d614315d224a8c
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/3b234fc6df54cca76bb74e3ae052dc43
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d01a48586072b4f2fc3182ba97f0e848b4d0b5642a12fc1180d614315d224a8c/
Verdict:
Malicious
Threat:
Family.RHADAMANTHYS
Link:
https://tip.neiki.dev/file/d01a48586072b4f2fc3182ba97f0e848b4d0b5642a12fc1180d614315d224a8c
Threat name:
Win64.Trojan.RadThief
Create hunting rule
Status:
Malicious
First seen:
2025-10-14 10:46:42 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2aneqwdaok2pf7brqk5jp4hijc2nbnlefijpyema2ykdcxjcjkga._file
Verdict:
malicious
Label(s):
rhadamanthys
Create hunting rule
plugdisk
Create hunting rule
Similar samples:
08f0da421004000e9ac5047c9d42776e36ab511285d19871f6d8370d30d516e5
Rhadamanthys
82628076e3c04a65f04a70b0fb727c43e6ab2e428ce7922b008451dbf7e57b31
Rhadamanthys
a8503016d7231bd7832b33baccb5ed771a5c3cba0ff1cd80133a334661e04eb8
Rhadamanthys
af0b1df56ccc89a58a1e3693379e032daa1ce83d29bb6428ad7a187eb216eb2a
Rhadamanthys
b4fd170f2d56421678f4743cba758fb69779b4bfd0f77202dbfc760d8ed1c8e5
Rhadamanthys
b858650183698417edd3c9679935c88d3c4ae4d905566a2757ee1afb0e6383cb
Rhadamanthys
cf101e60653e1a1af54335d9efb4e2942d32b8b8b1be729166ce528b0991e3f2
Rhadamanthys
d44b1975dc89972c3be507225df6ba9acbed927dac1523d831df0271db3a810a
Rhadamanthys
ecf7e8e17b502ca9e4b6274cf007bb8f9c18d0ad1518ce3911db3e70337958ab
Rhadamanthys
error
Rhadamanthys
+ 322 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251014-mvsnksfx4h/
Behaviour
Suspicious behavior: EnumeratesProcesses
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d71ac441-97ad-4fe7-8123-fa2372880f0c
Unpacked files
SH256 hash:
d01a48586072b4f2fc3182ba97f0e848b4d0b5642a12fc1180d614315d224a8c
MD5 hash:
3b234fc6df54cca76bb74e3ae052dc43
SHA1 hash:
3dda1c1aeb6602f240506e4fc19b58baae20a57f
Link:
https://www.unpac.me/results/7371e2d5-4b90-439a-87be-8804aebf1bb2/
Malware family:
GoInjector
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d01a48586072/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d01a48586072b4f2fc3182ba97f0e848b4d0b5642a12fc1180d614315d224a8c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/32659/

Comments