Analysis
-
max time kernel
155s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2023 17:07
Static task
static1
Behavioral task
behavioral1
Sample
79af3d56f147ca12b1bea965872338e4609d64efac9742103e11deed78b5f711.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
79af3d56f147ca12b1bea965872338e4609d64efac9742103e11deed78b5f711.exe
Resource
win10v2004-20230220-en
General
-
Target
79af3d56f147ca12b1bea965872338e4609d64efac9742103e11deed78b5f711.exe
-
Size
416KB
-
MD5
9adefd007c20b2d46239210d54c41335
-
SHA1
4b3b4a3295154e64e3b487391816fc70278b391f
-
SHA256
79af3d56f147ca12b1bea965872338e4609d64efac9742103e11deed78b5f711
-
SHA512
b9cbcd3321fae57b30da2b30fe7988b7c5a676b5a01a8b413b76f55928f312e30a0bf6347771722a86cab7926b9b092bfb18bd3f34996b97439eb987a8b64b2b
-
SSDEEP
6144:ixleYFZsOk3uIP8d5Jw0uKOew2Gyt3YuCSR2KkuAKvQ7LnFH/y:ixl3FZFk3R8fJwJKPbGcQDR1KkLnFH/
Malware Config
Extracted
rhadamanthys
http://179.43.142.201/img/favicon.png
Signatures
-
Detect rhadamanthys stealer shellcode 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4116-138-0x00000000025B0000-0x00000000025CC000-memory.dmp family_rhadamanthys behavioral2/memory/4116-140-0x00000000025B0000-0x00000000025CC000-memory.dmp family_rhadamanthys behavioral2/memory/4116-141-0x00000000025B0000-0x00000000025CC000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.