MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6df4dd06555404078b4e028fe2ba3eefd21f28978b9dd1567e2ea18588e89fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Rhadamanthys

Vendor detections: 16

Intelligence 16 IOCs YARA 1 File information Comments

SHA256 hash:	f6df4dd06555404078b4e028fe2ba3eefd21f28978b9dd1567e2ea18588e89fb
SHA3-384 hash:	31a30e68d932b5aef724fda6e2781f88f30c7d7da9b4bbdd7d3ad37bcbe78422d2cbc17b14f8745ca24889156bdcccd4
SHA1 hash:	3e0341a259d7151807d754cfbcc6ac4ea91e48e9
MD5 hash:	d989baacd931f43a7a60f8cc34ee61e1
humanhash:	mars-nineteen-pennsylvania-stairway
File name:	random.exe
Download:	download sample
Signature	Rhadamanthys Create hunting rule
File size:	1'992'192 bytes
First seen:	2025-10-28 07:24:25 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep	24576:g2BY+F7V0kjByaqZUkf3U3cqkXU83Arn9ic3Bq26J/9wDbfU26QCzwIze11+o:gha6kjaykf3ws3Arn9iaEdUDUARb
TLSH	T137953323D97553BFC7DE31707E925EC8E702B91E024F69C5624A179E8F2EE612B72060
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	abuse_ch
Tags:	exe Rhadamanthys

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

random.exe

Verdict:

Malicious activity

Analysis date:

2025-10-28 07:41:01 UTC

Tags:

rhadamanthys stealer websocket

Link:

https://app.any.run/tasks/14cce2ef-8449-4bcb-939c-929bcf31c692

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/34433/

Detection(s):

SecuriteInfo.com.Trojan.Lumma-1.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=690070305c3edf10df531b9c

Tags:

vmdetect overt spawn crypt

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for analyzing tools

Creating a window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Using the Windows Management Instrumentation requests

DNS request

Connection attempt

Sending a custom TCP request

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

amadey anti-vm crypt lumma microsoft_visual_cc obfuscated overlay overlay packed packed themidawinlicense unsafe zero

Link:

https://www.filescan.io/uploads/690072b33a79800405fa3e15/reports/2588a6b7-6019-4389-a98f-4df00100cf80/overview

Verdict:

Malicious

Labled as:

Symmi.Generic

Link:

https://www.hybrid-analysis.com/sample/f6df4dd06555404078b4e028fe2ba3eefd21f28978b9dd1567e2ea18588e89fb

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-10-27T07:53:00Z UTC

Last seen:

2025-10-27T09:15:00Z UTC

Hits:

~10

Detections:

Trojan.Win64.SBEscape.sb Trojan.Win32.Strab.sb HEUR:Trojan-PSW.Win32.Predator.gen HEUR:Trojan-PSW.Win32.Lumma.pef

Link:

https://opentip.kaspersky.com/f6df4dd06555404078b4e028fe2ba3eefd21f28978b9dd1567e2ea18588e89fb/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/753481b1-26c7-4500-9b46-c7ad6cd05e48

Result

Threat name:

RHADAMANTHYS

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1802983

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Hides threads from debuggers

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Potentially malicious time measurement code found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Yara detected RHADAMANTHYS Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f6df4dd06555404078b4e028fe2ba3eefd21f28978b9dd1567e2ea18588e89fb

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/d989baacd931f43a7a60f8cc34ee61e1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f6df4dd06555404078b4e028fe2ba3eefd21f28978b9dd1567e2ea18588e89fb/

Verdict:

Malicious

Threat:

Family.RHADAMANTHYS

Link:

https://tip.neiki.dev/file/f6df4dd06555404078b4e028fe2ba3eefd21f28978b9dd1567e2ea18588e89fb

Threat name:

Win32.Trojan.Symmi

Status:

Malicious

First seen:

2025-10-27 13:28:42 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=63pu3udfkvaea6fu4aup4k5d536sd4ujpc452flh4lvbqweorh5q._file

Verdict:

malicious

Label(s):

rhadamanthys

Similar samples:

error

Rhadamanthys

Result

Malware family:

n/a

Score:

10/10

Tags:

defense_evasion discovery

Link:

https://tria.ge/reports/251028-jfeavsvrax/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks BIOS information in registry

Identifies Wine through registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Suspicious use of NtCreateUserProcessOtherParentProcess

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/736d48a5-8552-4bdc-aabd-f58440e332b3

Unpacked files

SH256 hash:

f6df4dd06555404078b4e028fe2ba3eefd21f28978b9dd1567e2ea18588e89fb

MD5 hash:

d989baacd931f43a7a60f8cc34ee61e1

SHA1 hash:

3e0341a259d7151807d754cfbcc6ac4ea91e48e9

Link:

https://www.unpac.me/results/424ecf19-58c7-4937-b34c-21558a26cc85/

SH256 hash:

8906b71ca6c1936e818a6d18d626cf7a27490ee4a59c7b84d603879c8063cfe4

MD5 hash:

5d5f8aa706a715314bc61e3eb06e5796

SHA1 hash:

f08186a02176edf5dd3b24e51de616530de5079f

Link:

https://www.unpac.me/results/424ecf19-58c7-4937-b34c-21558a26cc85/

Malware family:

Rhadamanthys

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f6df4dd06555/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f6df4dd06555404078b4e028fe2ba3eefd21f28978b9dd1567e2ea18588e89fb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.