Overview

overview

10

Static

static

3

rh_0.4.9.exe

windows10-1703-x64

10

Resubmissions

27-11-2024 10:03

241127-l3hmxaypaw 10

01-08-2024 15:54

240801-tcb2fasenh 10

18-07-2023 20:01

230718-yrm5gaec6v 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rh_0.4.9.exe

  • Size

    456KB

  • Sample

    230718-yrm5gaec6v

  • MD5

    cf4914d021c5a5378428d6f5d3b1c57b

  • SHA1

    2dc95dc667cf4c49f78b4b8033cec85d889fd069

  • SHA256

    f0f70c6ba7dcb338794ee0034250f5f98fc6bddea0922495af863421baf4735f

  • SHA512

    c07408df7b0bb3f5f57482d9d93b79654e1eb1cb5e938c1e814b25ca6bdf5729c5de85c85b4e91116c38ba875b4611372f6452d1d2ad1e3f2be59b62009fae43

  • SSDEEP

    6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+n:2uWP/BZUyoLu8Agsmxwrvejkd2

Score
10/10
rhadamanthyscollectionstealer

Malware Config

Targets

    • Target

      rh_0.4.9.exe

    • Size

      456KB

    • MD5

      cf4914d021c5a5378428d6f5d3b1c57b

    • SHA1

      2dc95dc667cf4c49f78b4b8033cec85d889fd069

    • SHA256

      f0f70c6ba7dcb338794ee0034250f5f98fc6bddea0922495af863421baf4735f

    • SHA512

      c07408df7b0bb3f5f57482d9d93b79654e1eb1cb5e938c1e814b25ca6bdf5729c5de85c85b4e91116c38ba875b4611372f6452d1d2ad1e3f2be59b62009fae43

    • SSDEEP

      6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+n:2uWP/BZUyoLu8Agsmxwrvejkd2

    Score
    10/10
    rhadamanthyscollectionstealer

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Deletes itself

    • Accesses Microsoft Outlook profiles

      collection
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks