Overview

overview

10

Static

static

winprofile

windows7-x64

8

winprofile

windows10-1703-x64

10

Resubmissions

17-01-2023 00:12

230117-ag8resbf4t 10

16-01-2023 22:23

230116-2awbasad3z 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6

  • Size

    404.2MB

  • Sample

    230116-2awbasad3z

  • MD5

    fcb4b9dfe2f6ed4504410160001d03a7

  • SHA1

    2b66273ea2797e5ba3e33582da6d0f91f5e7833c

  • SHA256

    cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6

  • SHA512

    3373699f165aab7cccfb6062ac3c3a49d76fc7591f971a76ce4e6d3eb7e1f0fdfad2d71a7632bd5013a44d8b718ef510f3198c87572f58d828c5d68a613a9efa

  • SSDEEP

    49152:At33d2m6BN4NPGonVbx5Y3Va5i/QWKxLBNZZcAt:iQozTG3Va5iYJxLB7ZcA

Score
10/10
rhadamanthyssystembcstealertrojan

Malware Config

Extracted

Family

systembc

C2

45.147.197.24:4001

80.89.234.122:4001

Targets

    • Target

      cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6

    • Size

      404.2MB

    • MD5

      fcb4b9dfe2f6ed4504410160001d03a7

    • SHA1

      2b66273ea2797e5ba3e33582da6d0f91f5e7833c

    • SHA256

      cba50262e42c695572cd4591b025a3f81d28243faed9db98583af59639914be6

    • SHA512

      3373699f165aab7cccfb6062ac3c3a49d76fc7591f971a76ce4e6d3eb7e1f0fdfad2d71a7632bd5013a44d8b718ef510f3198c87572f58d828c5d68a613a9efa

    • SSDEEP

      49152:At33d2m6BN4NPGonVbx5Y3Va5i/QWKxLBNZZcAt:iQozTG3Va5iYJxLB7ZcA

    Score
    10/10
    rhadamanthyssystembcstealertrojan

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks