MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fed43d218c0e10df84e6d534358b859e9ed6fc3747f78de0081a6700f3f6b4c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Rhadamanthys


Vendor detections: 12


Intelligence 12 IOCs YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fed43d218c0e10df84e6d534358b859e9ed6fc3747f78de0081a6700f3f6b4c0
SHA3-384 hash: 72efa4a5d387461a0ee6254493fd6e205b289c458ae48da45a46ec8c6a8ba709c9a084bc458d5aab35921f4141ef841e
SHA1 hash: bf11b919f7c3edd512861a78a7a4ef1e8bab987b
MD5 hash: 2f43403c9ac75a091fca172c28e09ea2
humanhash: lithium-chicken-hot-alpha
File name:SetupKms.exe
Download: download sample
Signature Rhadamanthys
Create hunting rule
File size:7'411'837 bytes
First seen:2025-08-02 14:34:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 72c4e339b7af8ab1ed2eb3821c98713a (51 x BlankGrabber, 26 x PythonStealer, 7 x LunaStealer)
ssdeep 196608:xsm0W8/La5Sq+ysDTVUryT/HL+4uqJgL:UW8ES/RUrM/HLbgL
TLSH T1217633597B8408E8FC6FA33A98C54A8763F6B1624394D79757B00EA10E371E4FF28791
TrID 64.5% (.EXE) InstallShield setup (43053/19/16)
15.7% (.EXE) Win64 Executable (generic) (10522/11/4)
7.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.0% (.ICL) Windows Icons Library (generic) (2059/9)
3.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon 04b2f1e9b3f8e80d (1 x Rhadamanthys)
Reporter aachum
Tags:exe pyinstaller Rhadamanthys shim2-vurtobix-com shim2-zyraq-com shim4-familygater-com


Avatar
iamaachum
https://kmspico-download.celebritympg.com/ => https://sikubah.com/download/s/SetupKms.rar

This sample features techniques to avoid automated analysis.

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SetupKms.exe
Verdict:
Suspicious activity
Analysis date:
2025-08-02 14:35:44 UTC
Tags:
pyinstaller upx
Link:
https://app.any.run/tasks/b616910f-73c3-4bd0-8e7c-fa06e8712c52

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/18463/
Detection(s):
SecuriteInfo.com.FileRepMalware.22561.28030.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=688e223caf3050dc8d3387df
Tags:
installer extens virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Restart of the analyzed sample
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
expand invalid-signature lolbin microsoft_visual_cc overlay overlay packed packed pyinstaller signed
Link:
https://www.filescan.io/uploads/688e22379dbaf6e4b2210ff5/reports/36319588-18d5-42ec-b4c0-8cc930a8a815/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/fed43d218c0e10df84e6d534358b859e9ed6fc3747f78de0081a6700f3f6b4c0
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/7f5c6163-26b4-441d-967f-95893243b738
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1749080
Signature
Antivirus / Scanner detection for submitted sample
Found pyInstaller with non standard icon
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
69%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/fed43d218c0e10df84e6d534358b859e9ed6fc3747f78de0081a6700f3f6b4c0
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) Win 64 Exe x64
Link:
https://app.malva.re/file/2f43403c9ac75a091fca172c28e09ea2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fed43d218c0e10df84e6d534358b859e9ed6fc3747f78de0081a6700f3f6b4c0/
Verdict:
Malicious
Threat:
Win64.Certificate.Invalid
Link:
https://tip.neiki.dev/file/fed43d218c0e10df84e6d534358b859e9ed6fc3747f78de0081a6700f3f6b4c0
Threat name:
Win64.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-08-02 14:35:36 UTC
File Type:
PE+ (Exe)
Extracted files:
1683
AV detection:
9 of 24 (37.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=73kd2immbyin7bhg2u2dlc4ft2pnn7bxi73y3yaidjtqb47wwtaa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller upx
Link:
https://tria.ge/reports/250802-rx93vstny7/
Behaviour
Suspicious use of WriteProcessMemory
UPX packed file
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/9e30ea55-6147-47ce-b9db-25b97e85e2ea
Unpacked files
SH256 hash:
fed43d218c0e10df84e6d534358b859e9ed6fc3747f78de0081a6700f3f6b4c0
MD5 hash:
2f43403c9ac75a091fca172c28e09ea2
SHA1 hash:
bf11b919f7c3edd512861a78a7a4ef1e8bab987b
Link:
https://www.unpac.me/results/2ed0faa0-570b-4746-82d8-625989bb2743/
SH256 hash:
ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
MD5 hash:
a87575e7cf8967e481241f13940ee4f7
SHA1 hash:
879098b8a353a39e16c79e6479195d43ce98629e
Link:
https://www.unpac.me/results/2ed0faa0-570b-4746-82d8-625989bb2743/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fed43d218c0e10df84e6d534358b859e9ed6fc3747f78de0081a6700f3f6b4c0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:CAS_Malware_Hunting
Create hunting rule
Author:Michael Reinprecht
Description:DEMO CAS YARA Rules for sample2.exe
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Rhadamanthys

Executable exe fed43d218c0e10df84e6d534358b859e9ed6fc3747f78de0081a6700f3f6b4c0

(this sample)

Rhadamanthys

Microsoft Software Installer (MSI) msi 5e72de9f6789a9cda3df9f794ab3e26ff9b24611edf9e0f0cbc4d6a5d8e44bbb

  
Link
https://tria.ge/250802-rrkk1shr3v/behavioral1
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/18463/
  
Dropping
SHA256 5e72de9f6789a9cda3df9f794ab3e26ff9b24611edf9e0f0cbc4d6a5d8e44bbb
  
Dropping
MD5 3c83d3325933e2ca560781cf4930c593

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (FORCE_INTEGRITY)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::ConvertSidToStringSidW
ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::GetTokenInformation
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineW
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::FindFirstFileW
KERNEL32.dll::RemoveDirectoryW
KERNEL32.dll::SetDllDirectoryW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments