Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Resubmissions

27-11-2024 10:00

241127-l1pcnsynbw 10

22-06-2023 05:41

230622-gdfd2aea2t 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    448KB

  • Sample

    230622-gdfd2aea2t

  • MD5

    2809bff19753a15b31614cddde67f245

  • SHA1

    aee8f16a80a6422885f3328d90a3621719249f96

  • SHA256

    6266cd88962428cfc873a4c0390491375e91505a66e0165ec476e3be724b9b65

  • SHA512

    b3d71df8109f205b3451fcba3bfa6ec5c7a39213d9bd90536d3ba438b8648d10cd1d95921ff8dae0b4797840f136c1e7004ce3b0d36f72a600fb735bc121f404

  • SSDEEP

    6144:L/E8DIpjK28t4snQalp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zi:dEpj7snJv/cgu4VGn6OaM+ucj

Score
10/10
rhadamanthysevasionstealer

Malware Config

Targets

    • Target

      file.exe

    • Size

      448KB

    • MD5

      2809bff19753a15b31614cddde67f245

    • SHA1

      aee8f16a80a6422885f3328d90a3621719249f96

    • SHA256

      6266cd88962428cfc873a4c0390491375e91505a66e0165ec476e3be724b9b65

    • SHA512

      b3d71df8109f205b3451fcba3bfa6ec5c7a39213d9bd90536d3ba438b8648d10cd1d95921ff8dae0b4797840f136c1e7004ce3b0d36f72a600fb735bc121f404

    • SSDEEP

      6144:L/E8DIpjK28t4snQalp3z/pSZ+pDKpf9EkQbKxVK+PXItNOapG8RuzRiRh3Zi:dEpj7snJv/cgu4VGn6OaM+ucj

    Score
    10/10
    rhadamanthysevasionstealer

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Enumerates VirtualBox registry keys

      evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks