MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4b72ede86422c14033614daff35a37789e14193ec31a07284d27a64bcb56269. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e4b72ede86422c14033614daff35a37789e14193ec31a07284d27a64bcb56269
SHA3-384 hash:	1a4247d53dcd9c1807ceca6c2b994488641779784991512729729d57136c2c41815b238bfb01a37872e1105aa1a3641b
SHA1 hash:	d6bb82a82742496af02723094afe5e394b329018
MD5 hash:	4740364a8026b5c062f7ee48006c3cef
humanhash:	hotel-uncle-quebec-florida
File name:	appFile_patched.exe
Download:	download sample
Signature	Rhadamanthys Alert Create hunting rule
File size:	101'838'846 bytes
First seen:	2025-05-23 20:47:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	bf95d1fc1d10de18b32654b123ad5e1f (327 x LummaStealer, 65 x Rhadamanthys, 25 x Vidar)
ssdeep	24576:I0a6Tbe/y7a0syS3j/IPchYd/C6QobCwPeNwXz3kaxp8eMa3obOI:In1XbIiYNtnPeNulxp8yvI
Threatray	389 similar samples on MalwareBazaar
TLSH	T1982823D2F7B5528E5513AA7126A60C833B3E76F6D25001257A41B21D34E6F20A3BF63F
TrID	37.3% (.EXE) Win64 Executable (generic) (10522/11/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	1cdc82a282fc3e03 (1 x Rhadamanthys)
Reporter	aachum
Tags:	45-153-34-122 AutoIT CypherIT de-pumped exe Rhadamanthys

iamaachum

https://med1a.n1t843se3.cyou/Internet_Download_Manager_%28IDM%29_v6.42_Build_36_%2B_Fix_%5BLifetime_A.zip?c=AGbbMGgvYwUAXFgCAEVTFwAMAAAAAACy&s=353071 => https://arch.dow034.cfd/g/zip/L030wg54k5YVhqXLMskIZdy7/Internet_Download_Manager_(IDM)_v6.42_Build_36_+_Fix_%5BLifetime_A.zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

862

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6830e25e44c3881e854c8402

Tags:

autoit emotet cobalt

Dr. Web vxCube Suspicious

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Searching for the window

Creating a window

Creating a file in the %temp% directory

Сreating synchronization primitives

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

Searching for synchronization primitives

Creating a file

Creating a process from a recently created file

DNS request

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

blackhole installer microsoft_visual_cc overlay overlay packed packer_detected

Link:

https://www.filescan.io/uploads/6830df25fd02ed5e05856048/reports/375257f9-c042-4969-bcb2-e1b0340e285f/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e4b72ede86422c14033614daff35a37789e14193ec31a07284d27a64bcb56269

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1698252

Signature

.NET source code contains potential unpacker

Drops PE files with a suspicious file extension

Early bird code injection technique detected

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sigma detected: Search for Antivirus process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Uses threadpools to delay analysis

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

93%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/e4b72ede86422c14033614daff35a37789e14193ec31a07284d27a64bcb56269

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Adware.RedCap

Threat name:

Win32.Adware.RedCap

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-23 20:48:43 UTC

File Type:

PE (Exe)

Extracted files:

21

AV detection:

8 of 38 (21.05%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4s3s5xugiiwbiazwctnp6nndo6e6cqmt5qy2a4ue2j5gjpfvmjuq._file

Threatray rhadamanthys

Verdict:

suspicious

Label(s):

rhadamanthys

Alert

Create hunting rule

Similar samples:

19d77d97663457414d820acd36132be149a51e671e11b1120189e9f4a87dd2e3

Rhadamanthys

241f116274b24d95b2ed46ad026e75d57a0ce2ee98c3425ac850457aff683313

Rhadamanthys

34c1fa75e41c74e2cc1887fce11add7e9bee9147bc9767ffe71b6806a4cee9c3

Rhadamanthys

509db618a8673332107f51db4854b7010cb693cc317d93340f356a345c7489c4

Rhadamanthys

63c1511bdd68d12623147ed555454d75c15e437e5897417d7c2974eac2887777

Rhadamanthys

9f0499b0c6aa625b84052ed034de82dcb48af02bbd340e8fd87693a1b70b5db4

Rhadamanthys

error

Rhadamanthys

f3d293b413b4afdf8f2b2d8b6aa21c4a9cab4046eb82a550edcd552974b56f90

Rhadamanthys

fccb531144971b684129a0827c65902334e3e6e30a92f7122c44521e76c82740

Rhadamanthys

fe437257792a8a06e59cab1c6c4d446a14a93557a84b0ab97c980fe23ec83f93

Rhadamanthys

+ 379 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery

Link:

https://tria.ge/reports/250523-zlpxjsam5x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Drops file in Windows directory

Enumerates processes with tasklist

Checks computer location settings

Deletes itself

Executes dropped EXE

Threat.Zone Malicious

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5d355ac1-ba1a-4c5c-8442-f57a7e205cf3

VMRay CypherIt

Malware family:

CypherIt

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e4b72ede8642/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.