General

  • Target

    c0669e66ee76b460bb9e7302e2f8f613242c91270115059118854a35977b22c2

  • Size

    7KB

  • Sample

    230203-g2qvnsfb5z

  • MD5

    2b53f2a5d7af79552a63a22f990e31ea

  • SHA1

    2887d0882645bab0296a5b1ee3eab11b45549533

  • SHA256

    c0669e66ee76b460bb9e7302e2f8f613242c91270115059118854a35977b22c2

  • SHA512

    e641ca2d1feb0717a9c5b4fad5a3c0c4e160b95d45dc4b8f06053dc20405dbfbb9f43a4aecef7194e9058542db8f38b2d98a2e44d895768519cf82ef2e065d7d

  • SSDEEP

    96:Ot5wsUHE3mr2/CnA3NBG7ILPzLA+95Gd8sY1C16yt3kh0zttKpHR5q9jYzNt:OYHExCvsL9kOstUh0ztIHPr

Malware Config

Targets

    • Target

      c0669e66ee76b460bb9e7302e2f8f613242c91270115059118854a35977b22c2

    • Size

      7KB

    • MD5

      2b53f2a5d7af79552a63a22f990e31ea

    • SHA1

      2887d0882645bab0296a5b1ee3eab11b45549533

    • SHA256

      c0669e66ee76b460bb9e7302e2f8f613242c91270115059118854a35977b22c2

    • SHA512

      e641ca2d1feb0717a9c5b4fad5a3c0c4e160b95d45dc4b8f06053dc20405dbfbb9f43a4aecef7194e9058542db8f38b2d98a2e44d895768519cf82ef2e065d7d

    • SSDEEP

      96:Ot5wsUHE3mr2/CnA3NBG7ILPzLA+95Gd8sY1C16yt3kh0zttKpHR5q9jYzNt:OYHExCvsL9kOstUh0ztIHPr

    • Detect PureCrypter injector

    • Detect rhadamanthys stealer shellcode

    • PureCrypter

      PureCrypter is a .NET malware loader first seen in early 2021.

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks