rhadamanthys

Resubmissions

07/03/2023, 12:55

230307-p56pasaa85

23/01/2023, 13:41

230123-qzjg9add7910

27/12/2022, 17:22

221227-vxl8ksfd9710

27/12/2022, 17:10

221227-vprhbsae8t10

Sharing

Copy URL Twitter E-mail

General

Target
VirtualBox_7.0-Download_Old_Builds_-_About_-_Documentation.zip
Size 45.8MB
Sample221227-vprhbsae8t
SHA256 e198a1cf6988b3e8bffa5dec0b28c891c5ef4116c71fbc94d9a68ed9e9b444eb
MD5 af64b7e90c6ab6ab41d30f3560493a5f
SHA1 28395db17798078b1db06514c4ef2a089c3988ef
SHA512 36bc1b46b5dfe174ba742538425261bd2389e535b7e95a8d9def9ef7a6899c70dbec7043775e3f18d05c96988042863c40b95c0acf682a3a4474263430b9dc48
SSDEEP 786432:cFcvFCL49PhTxLca5qMIgaNC8yXFV8QWVbQWV8QkVOQOVwQPVZQl6tFX2NGWN6nh:cFcvFj9DLP5q1rN1QCQRQDQNQ7Ql6tFr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  VirtualBox 7.0-Download_Old_Builds - About - Documentation.exe
- Size 727.0MB
- SHA256 ab378c4f2a52e1c4a5e199917e37a4d58a4f2c0d7585bb6f68f353d4018aba8c
- MD5 8d10972d8f4c00b6811783823e2e3ec6
- SHA1 f6c86e26b6e55c71a02ee932bb0bae7200feaae1
- SHA512 27636191bd6c1da31cf0fee717c6fd612b2b5aa8b65e9ffa85566852abc6e12860b89baf3e50aeb6b2138a220d3bc737e6fa53b16983de3d04df5a9c239bfb97
- SSDEEP 12288:JgWkSNSTtX+5kOzIGgn/5HY5o8e3Fu3R+ZysWra9PtdBtSt6x4fOddti1ySgJly8:fkSy+510TnDPPvit6x4wi1ySgJlWVO
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

rhadamanthys collection discovery spyware stealer
- Detect rhadamanthys stealer shellcode
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Blocklisted process makes network request
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Detect rhadamanthys stealer shellcode

Blocklisted process makes network request

Loads dropped DLL

Reads user/profile data of web browsers

Accesses Microsoft Outlook profiles

Checks installed software on the system

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2