rhadamanthys | d5d5b80a12be4845f2c4d23cdf01b6a690ceddcb8bb923df7d59bf5cd2057a6f | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

1

tmp.exe

windows7-x64

tmp.exe

windows10-2004-x64

Sharing

General

Target

tmp
Size

369KB
Sample

230203-f2kg8abc65
MD5

c901cbc0e7e675c98d6ccc17e453d99f
SHA1

76f1958a6fe532b472f60361bff3b0f8bda2c86f
SHA256

d5d5b80a12be4845f2c4d23cdf01b6a690ceddcb8bb923df7d59bf5cd2057a6f
SHA512

3da5b084aafa0f700ada7a4675499032e9fa60557f8de3c01fc7983eda405d3d906bc581ffc4993e47b37663ca7932240d25b3e1fb45b8ed9471e9bce54566c2
SSDEEP

6144:WMRGQL7XoNR9ZsekVOt/hihbxQLy+qKKwTAVYxQkINPNNrlwKwpxBm94QjV6ptCa:WMRGQvXuRHsqZhihbxgaKPixDrleGT

Score

10^/10

rhadamanthys collection discovery spyware stealer

Static task

static1

Behavioral task

behavioral1

Sample

tmp.exe

Resource

win7-20221111-en

rhadamanthys collection discovery spyware stealer

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

tmp.exe

Resource

win10v2004-20221111-en

rhadamanthys collection discovery spyware stealer

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  tmp
- Size
  
  369KB
- MD5
  
  c901cbc0e7e675c98d6ccc17e453d99f
- SHA1
  
  76f1958a6fe532b472f60361bff3b0f8bda2c86f
- SHA256
  
  d5d5b80a12be4845f2c4d23cdf01b6a690ceddcb8bb923df7d59bf5cd2057a6f
- SHA512
  
  3da5b084aafa0f700ada7a4675499032e9fa60557f8de3c01fc7983eda405d3d906bc581ffc4993e47b37663ca7932240d25b3e1fb45b8ed9471e9bce54566c2
- SSDEEP
  
  6144:WMRGQL7XoNR9ZsekVOt/hihbxQLy+qKKwTAVYxQkINPNNrlwKwpxBm94QjV6ptCa:WMRGQvXuRHsqZhihbxgaKPixDrleGT
Score

10^/10

rhadamanthys collection discovery spyware stealer
- Detect rhadamanthys stealer shellcode
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Blocklisted process makes network request
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

rhadamanthyscollectiondiscoveryspywarestealer

behavioral2

rhadamanthyscollectiondiscoveryspywarestealer

© 2018-2025

Terms | Privacy