MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d44b1975dc89972c3be507225df6ba9acbed927dac1523d831df0271db3a810a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 16

Intelligence 16 IOCs YARA 1 File information Comments

SHA256 hash:	d44b1975dc89972c3be507225df6ba9acbed927dac1523d831df0271db3a810a
SHA3-384 hash:	12632b98d67bb543cd078666f3ef061802fd137b72b0354ac0a0d8005c9541d0c3afd8bfc2d074c0cc2635b56464772d
SHA1 hash:	c4f3207f4ac8a5f6a9acd67e7d1ef68c4d09059f
MD5 hash:	07d7abac05f1d2aca01dd340a66e6c42
humanhash:	butter-kentucky-minnesota-winter
File name:	SecuriteInfo.com.Win64.MalwareX-gen.26218288
Download:	download sample
File size:	10'272'768 bytes
First seen:	2025-10-08 16:20:18 UTC
Last seen:	2025-10-12 04:05:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	5a04a0e7e62f8b207804df45b5571588 (10 x Rhadamanthys, 1 x OyesterLoader)
ssdeep	196608:npr2QjmxGcbnXebTP/7qAd6a/5r46J2CT9+Ez4Q8YA47MJj:xmokX6TbZ6a/dJ2CDiN4g9
Threatray	1 similar samples on MalwareBazaar
TLSH	T19DA612E652C8B7B9C0C24A1C7401419B38C0AD9984EDDD58BBC76C53DF52EAE149EBE3
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

0_c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45.exe

Verdict:

Malicious activity

Analysis date:

2025-10-08 13:56:59 UTC

Tags:

auto redline stealer amadey botnet rdp anti-evasion loader ms-smartcard github phishing

Link:

https://app.any.run/tasks/1c7dd6eb-b11e-4236-afa8-e3261467b7e0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/31157/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e68f64277c2bd8bc5defc1

Tags:

spawn

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Launching a process

Using the Windows Management Instrumentation requests

Detecting VM

Connecting to a non-recommended domain

Connection attempt

Sending a custom TCP request

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/68e68f647c75fa33a2786b90/reports/f28c2177-8204-4720-996b-9ec9d633a0a2/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/d44b1975dc89972c3be507225df6ba9acbed927dac1523d831df0271db3a810a

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-10-08T11:25:00Z UTC

Last seen:

2025-10-09T10:18:00Z UTC

Hits:

~100

Detections:

Trojan.Win32.Inject.sb Trojan.Win32.Agent.sb Trojan.Win32.Crypt.sb Trojan-Dropper.Win32.Injector.sb Trojan.Win64.SBEscape.sb Trojan.Win64.SBEscape.ayi

Link:

https://opentip.kaspersky.com/d44b1975dc89972c3be507225df6ba9acbed927dac1523d831df0271db3a810a/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/77af2273-07cd-48f1-9bb8-2691d3542e1d

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d44b1975dc89972c3be507225df6ba9acbed927dac1523d831df0271db3a810a

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/07d7abac05f1d2aca01dd340a66e6c42

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d44b1975dc89972c3be507225df6ba9acbed927dac1523d831df0271db3a810a/

Verdict:

Malicious

Threat:

Family.RHADAMANTHYS

Link:

https://tip.neiki.dev/file/d44b1975dc89972c3be507225df6ba9acbed927dac1523d831df0271db3a810a

Threat name:

Win64.Trojan.Egairtigado

Status:

Malicious

First seen:

2025-10-08 15:10:09 UTC

File Type:

PE+ (Exe)

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2rfrs5o4rglsyo7fa4rf35v2tlf63et5vqkshwbr34bhdwz2qefa._file

Verdict:

malicious

Label(s):

rhadamanthys

error

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://tria.ge/reports/251008-ttkpxayyc1/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Deletes itself

Suspicious use of NtCreateUserProcessOtherParentProcess

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/ebbcb67a-6536-40d7-acef-2c37692e1f4e

Unpacked files

SH256 hash:

d44b1975dc89972c3be507225df6ba9acbed927dac1523d831df0271db3a810a

MD5 hash:

07d7abac05f1d2aca01dd340a66e6c42

SHA1 hash:

c4f3207f4ac8a5f6a9acd67e7d1ef68c4d09059f

Link:

https://www.unpac.me/results/1b76afb9-aea6-47ed-8a0d-b551ea1151b1/

Malware family:

Rhadamanthys

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d44b1975dc89/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d44b1975dc89972c3be507225df6ba9acbed927dac1523d831df0271db3a810a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.