rhadamanthys | 032e861138d0a304d5a51bc7614f867b04d558596be03cf69ff9fd63098bc46d

Resubmissions

10-05-2023 00:46

10-05-2023 00:39

max time kernel
38s
max time network
40s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-05-2023 00:46

Target

setup.exe
Size

365KB
MD5

0bf4802d6222aa624709e90092916233
SHA1

1434523ea8f30bfdd051570badb258f36c8eaa05
SHA256

032e861138d0a304d5a51bc7614f867b04d558596be03cf69ff9fd63098bc46d
SHA512

1cb68f4591bc40ba544cc2fa19fa9aaa59e6a497d075b85f2c3dd47f601745d1f500ef9a4286ebd32dc12880529ce850656382c95f7ac060e70c7e89686490c7
SSDEEP

6144:98Q7t/ifdZQR1u4U3QScXaviBoGnGoTCOhwK:mS/if6VScXaaagCzK

Score

10^/10

Family

rhadamanthys

http://179.43.142.201/img/favicon.png

Detect rhadamanthys stealer shellcode 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1204-59-0x0000000000290000-0x00000000002AC000-memory.dmp	family_rhadamanthys
behavioral1/memory/1204-60-0x0000000000290000-0x00000000002AC000-memory.dmp	family_rhadamanthys
behavioral1/memory/1204-62-0x0000000000290000-0x00000000002AC000-memory.dmp	family_rhadamanthys

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
PID:1204

memory/1204-55-0x0000000000260000-0x000000000028E000-memory.dmp

Filesize
184KB

Download
memory/1204-56-0x0000000000400000-0x00000000006D9000-memory.dmp

Filesize
2.8MB

Download
memory/1204-59-0x0000000000290000-0x00000000002AC000-memory.dmp

Filesize
112KB

Download
memory/1204-61-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1204-60-0x0000000000290000-0x00000000002AC000-memory.dmp

Filesize
112KB

Download
memory/1204-62-0x0000000000290000-0x00000000002AC000-memory.dmp

Filesize
112KB

Download
memory/1204-63-0x0000000000400000-0x00000000006D9000-memory.dmp

Filesize
2.8MB

Download