Overview

overview

10

Static

static

1

@Base_1Exp1.exe

windows7-x64

10

@Base_1Exp1.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    @Base_1Exp1.exe

  • Size

    1.1MB

  • Sample

    240214-qkqysabe9t

  • MD5

    a61a6edcabbec623b95f47d0f5de31d0

  • SHA1

    59b1917a6d7551077d990f327708070fc6de0100

  • SHA256

    427e34c4590ec050498749631ead8449afe645ae0372e3d805f16738844044e5

  • SHA512

    4b7918a571f376f376c437283772402e40610df0b0bdec8b8238c51da984a12621b1c947a7983a59bd9f1b7708a995eca0c7ce7f42b1e8ee371a4f5a66b5e912

  • SSDEEP

    12288:l+1WbCPLQhXW9XUvNHBAGe5YhnUAQyjTeFEJvRshKXAfY:ULIW5uXKA7jTeFEdRshC

Score
10/10
rhadamanthyspersistencepyinstallerstealer

Malware Config

Targets

    • Target

      @Base_1Exp1.exe

    • Size

      1.1MB

    • MD5

      a61a6edcabbec623b95f47d0f5de31d0

    • SHA1

      59b1917a6d7551077d990f327708070fc6de0100

    • SHA256

      427e34c4590ec050498749631ead8449afe645ae0372e3d805f16738844044e5

    • SHA512

      4b7918a571f376f376c437283772402e40610df0b0bdec8b8238c51da984a12621b1c947a7983a59bd9f1b7708a995eca0c7ce7f42b1e8ee371a4f5a66b5e912

    • SSDEEP

      12288:l+1WbCPLQhXW9XUvNHBAGe5YhnUAQyjTeFEJvRshKXAfY:ULIW5uXKA7jTeFEdRshC

    Score
    10/10
    rhadamanthyspersistencepyinstallerstealer

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks