Overview

overview

10

Static

static

3

wininstal.exe

windows7-x64

7

wininstal.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    wininstal.exe

  • Size

    607KB

  • Sample

    230918-mx2dhagg7t

  • MD5

    dd81fe6d37b5200c80eccb98bc8b91d9

  • SHA1

    55371613874ea2109b6fc42f929e15f8544cb532

  • SHA256

    7d5455411512b3e4fa266722bc5bfd18d73b84edf984543f12b40bfc274a70c7

  • SHA512

    fc2525ec43c03ab7f2c9dfed92f18ec58ef79e962bc2089da90bc565d5d8d8564d9bf4d545c26fdb271c5b88d5ba47c73225f37f49ca1ffff17d427361aefb4a

  • SSDEEP

    12288:bisrBllxd6M2YYKZ7UcxrGJnFdz87yrqE3Wopb7z1fbJBRi1rMM17o4:bdNllr6MWKZ7Uc0JnLpqED7z1frw1MMB

Score
10/10
rhadamanthyscollectionpersistencestealer

Malware Config

Targets

    • Target

      wininstal.exe

    • Size

      607KB

    • MD5

      dd81fe6d37b5200c80eccb98bc8b91d9

    • SHA1

      55371613874ea2109b6fc42f929e15f8544cb532

    • SHA256

      7d5455411512b3e4fa266722bc5bfd18d73b84edf984543f12b40bfc274a70c7

    • SHA512

      fc2525ec43c03ab7f2c9dfed92f18ec58ef79e962bc2089da90bc565d5d8d8564d9bf4d545c26fdb271c5b88d5ba47c73225f37f49ca1ffff17d427361aefb4a

    • SSDEEP

      12288:bisrBllxd6M2YYKZ7UcxrGJnFdz87yrqE3Wopb7z1fbJBRi1rMM17o4:bdNllr6MWKZ7Uc0JnLpqED7z1frw1MMB

    Score
    10/10
    persistencerhadamanthyscollectionstealer

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks