Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
04-05-2023 05:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3fb7ec0981c88cec89df6938268c77e12735e554f51fac7070617745715ba787.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
3fb7ec0981c88cec89df6938268c77e12735e554f51fac7070617745715ba787.exe
-
Size
381KB
-
MD5
d82c480218096a49b6cae19d3baef01d
-
SHA1
a8f65e7f6a92fd7b7ba15716dbf841c042c679dd
-
SHA256
3fb7ec0981c88cec89df6938268c77e12735e554f51fac7070617745715ba787
-
SHA512
f9eb62689ad49d9444de8c3b05d1a73e627e81a8fa64dabf75d86cfb48a5917f2605f1db6bba1106d640221461edcecf30e1c5156a6c3bc72ca7c3327bdd5632
-
SSDEEP
6144:9sMYwxbgCHywKQ+pBV4IYw7AvyznaISdBtl:SixD1+pf4CAKznxSdL
Score
10/10
Malware Config
Extracted
Family
rhadamanthys
C2
http://179.43.142.201/img/favicon.png
Signatures
-
Detect rhadamanthys stealer shellcode 4 IoCs
Processes:
resource yara_rule behavioral1/memory/4632-139-0x0000000002480000-0x000000000249C000-memory.dmp family_rhadamanthys behavioral1/memory/4632-140-0x0000000002480000-0x000000000249C000-memory.dmp family_rhadamanthys behavioral1/memory/4632-142-0x0000000002480000-0x000000000249C000-memory.dmp family_rhadamanthys behavioral1/memory/4632-144-0x0000000002480000-0x000000000249C000-memory.dmp family_rhadamanthys -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.