Extracted

• • Target
    NightVerse Setup.exe
  • Size 47.5MB
  • SHA256 af0a92ede514d4efa9e6abb5206ed59214d5eb7f9dc700c868e59db5958334dc
  • MD5 cea284c77310b04439f6323b456e7730
  • SHA1 aa2e784b2fe1440fd2ef270e3349a9089ac0f164
  • SHA512 f51dc1069ae807fa780c657d33daa6b2649bb2514addc162b57b520b746c4b36f2155fd2665673f3677a82f42415616dd7bca9ddbe40aad0168ed8dbbbba5153
  • SSDEEP 786432:Pjk/rEE6GfsUmlBxQDA1qh7UoodKJlknLpNdLzlxImkYGeF/tP:Pg/r9JUUsvQDaWUnoaxj/tP
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcdiscoveryspywarestealerrhadamanthys

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    zh-Hans/PresentationUI.resources.dll
  • Size 42KB
  • SHA256 aa454ef5be05a806d51a0f350adf6d1769a161d765a818dfefe394c20eab64c6
  • MD5 19783e0668a147ad36af534ed0a14193
  • SHA1 349fe8589570565b02876fb51fc761600a43bb10
  • SHA512 8aad9a1fa3148dfd926e5ffa56a1343fe2db909a7a814312464f331a52641b6296cde093e231a964ee204e75f5b2e5923e81e45a32296e6b82def4a696e1b266
  • SSDEEP 768:GKed0SYi7Skr+FoyNh1hn0A3Prs4vgXfMGv5YdcSsmC5YUghVOA/K/iQHji9z6O:Cd0SYiTiHn0A3Prs4vcfMGv5YdcSsmC8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral3behavioral4
• • Target
    zh-Hans/ReachFramework.resources.dll
  • Size 36KB
  • SHA256 b75111e46193b174a4ddc4d39a112ef8c023a5c693df6650a5f1410e0016f7ef
  • MD5 0c4ba0386a3c1b922dd70a78da4ce64f
  • SHA1 83c098de0b86bec573203bea59425605e659f42c
  • SHA512 ef74c6291aa6eea1a0a1800e89682e1a599a97227730bf55e7bc06dce5d04224968e713ef8e797c22d2ae52c4787f6538bde9f704b0dced7f19540e1fa63f7ea
  • SSDEEP 768:F/UOgMne+nvV9fWpVPKFPl27L2vRmjJAU0rXRCOD8j34GTZy0heSS15WyItgUmdp:GOgMne+nvVuI0wKKItgUmdSZ7iwGtIir
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral5behavioral6
• • Target
    zh-Hans/System.Windows.Controls.Ribbon.resources.dll
  • Size 18KB
  • SHA256 a30c681bf7b52d6f91309fd921bf80df2ce7119c00d8a66330cb8945e48186c5
  • MD5 df2fc6490e58edfa221e393681ad6fda
  • SHA1 cbe533d79bd74154c0a42cee7bb0fa20150bc966
  • SHA512 0fcd8e190100be81e64850022af1ebc107f04be94132e65b531161c3b5925a31a1e7b05f0dd5e3d6f4710b4b83ffe0486f5814dfe1a08f417343a036e5749f65
  • SSDEEP 384:WhWu5Q36ertWV875kHRN7W++5I+R9zJKR4:iHQ36eI5WEi9zER4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral7behavioral8
• • Target
    zh-Hans/System.Windows.Forms.Design.resources.dll
  • Size 141KB
  • SHA256 1fd16be3c684b2a127785790e355b031eacbb4e81b7891ab621d7db01dabd504
  • MD5 62955b45cce45d9fd1cfcf0d946f6777
  • SHA1 e76accd806ebadd6051805cf034c9386bfe40e9e
  • SHA512 ccb0ab489f3710fa5e1ef5cf8c111d98c7a22a719e363ad31a36349b35129d00c8026bc85165f95fd223452765e941332e47e508058c2769d2f8df6706a0546d
  • SSDEEP 3072:b5R9MtbGzbtyHZ/I11DKdwWorcP4IVCLAFmbZanokelG5YCVHBqDBvQBaKpWmsSm:bzSXJSHea/Iv2uo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral10behavioral9
• • Target
    zh-Hans/System.Windows.Forms.Primitives.resources.dll
  • Size 15KB
  • SHA256 5bd79876c04b7a4b63ca0cd78edcde2e10770aa9f1ddf0c7c7132877f79d88c0
  • MD5 6fa9fed408ade2884a94e7c8d1a7778c
  • SHA1 6df1a4f1e7fc14479e4e39c0dcc3d140cf12ff7c
  • SHA512 56dd8ea02662d380afe46670f569a76fa3b184f7081cea80382caaed47780a4c1cc1d3f9f7c89018a19c3a39737706b18e2300f34a00cd453104491630ea10f4
  • SSDEEP 192:U7A6wePqOUWNiW4uWXebPpUNTQHnhWgN7aIWdSsRH+BEg7X01k9z3AQdKa:z6DqbWNiW4Tb2HRN7G8R9zr4a
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral11behavioral12
• • Target
    zh-Hans/System.Windows.Forms.resources.dll
  • Size 312KB
  • SHA256 86ee444b40d7e5b1bc3079b17e600998f15570860948faf0e3327b7daaf39fa8
  • MD5 e9bcfcbd6ff63082c1af190cfb6e000d
  • SHA1 e6597132638cec51a30ea169bad12ed7e78c2797
  • SHA512 cfdf45d9a872bb6d2314627c5eca1c47d207c8c70c1dfe661499786d106413ff1b5ae19f2a300c8b04052c3c3bb7f5eba9ffc8b19c1504277536d7afd8cef433
  • SSDEEP 6144:CqcUKNvHTngTvI4v18GWwPGtzwkbmNp6htBrF:CqcU9NyF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral13behavioral14
• • Target
    zh-Hans/System.Windows.Input.Manipulations.resources.dll
  • Size 16KB
  • SHA256 ab6c90e2050952dce7998487178901baa8f8e1415579666ab8332b6f73df3aaf
  • MD5 185eb76baf903123ce675848246f6433
  • SHA1 c412595c9b3e40365d78ecf29ead7c2818b3d292
  • SHA512 2fcbc6da5d780ba31a584dc65370732418644cd636722f443f0c66bebc6c56af7b3337790e4104d5af0183ee6d6a49012adfaa5516cd0d611fde698981a87e34
  • SSDEEP 192:Xvh5I0AY+ptHCvZJaaQWpgjhuWXebPpUNTQHnhWgN7a8WnDasZmp8TKjX01k9z31:XpBE8QWpgjhTb2HRN7ZssWAR9zgX2iiN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral15behavioral16
• • Target
    zh-Hans/System.Xaml.resources.dll
  • Size 59KB
  • SHA256 02badcc47cdfcf8a361bc9109024b911ef8882e0069d3a9397d66ea0189978e6
  • MD5 d8a8c0ef8cb33fa59c223b5646e492e7
  • SHA1 6c8978eec29a9e5a5e4e6fb16261df88480c655c
  • SHA512 0e6c81dc379912ec8ad89384d135b159e39dbcd23ae70e244d41e39b8e6d50cf1e0d0119c94ac9f29e0ae9ded3d4649506ab61faf412971b946a03182da363cc
  • SSDEEP 768:lZOvyTuLqN/q1SqsT+lGnTrcmc0oDSM13OQK3KG9/D+3CPQxU08ziXRmgu4O7/i9:avyXPjAmu32KfyyZmr4OLip9zTN
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral17behavioral18
• • Target
    zh-Hans/UIAutomationClient.resources.dll
  • Size 19KB
  • SHA256 08ad355f4e8eda849a3ace50b8c939dabb1f4669910f7837a047ac2ffd7b9c4a
  • MD5 cacba1037a31dc19efdb546ae0faadd5
  • SHA1 1ad9f3e66969294fef49ac6eb6803b04761146b3
  • SHA512 f802d0d9c7abb1cae13cdc4cd444188df8cdf9348073e7c2e0958289eedcaf75904b1f0b8caf7dafbc25be35458c06b0ba38e1aeb324d03784e5b0038c5b6f78
  • SSDEEP 384:afet3+LgiuatiF8tWSKAITb2HRN7oEnR9zV6Kbmv:Iet32g76iFrb/ioER9zVtbmv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral19behavioral20
• • Target
    zh-Hans/UIAutomationClientSideProviders.resources.dll
  • Size 20KB
  • SHA256 969b0fe234d4c281140e526041b143947c0cdb5c363568bba05b3023701f239a
  • MD5 1ad80ceccbf82de5c4cb84192a8047f8
  • SHA1 a3626848a531c5a94ba4cb618ea54ecee0c8a252
  • SHA512 22433e7fb5418df762b93cd44974dd60b55642bd385b2cd52c1a38073d387c153dc5ff7866efb340a9e8cf8a9f10219520d70a15b2ef6f115c11a447a2ff2438
  • SSDEEP 384:6sRBH3FD8YtWKXUTb2HRN7Q/uVwR9z1PPBx:JRB3Fo4k/io9zZPH
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral21behavioral22
• • Target
    zh-Hans/UIAutomationProvider.resources.dll
  • Size 15KB
  • SHA256 1b6f884d9956d737e34c41eb2013b782f5024164b11ae5006b88575947ab89c4
  • MD5 fea5351b7d23ece45687934c15ef8dcb
  • SHA1 744364cf4f0fd65e5001c33bcf3d4f6c66583f8c
  • SHA512 cf4fa7095bcd855e68e4243b9906598a7b7b30ff8a2717b58c0692dc3d97e118ac83350dfa8dc02c750a549307ff78717c855dad7c264577b063fb85e1715556
  • SSDEEP 192:zZ3Z3r6WtZF2tWb+juWXebPpUNTQHnhWgN7a8WqdvYKKWDKHjj3SX01k9z3A8FPt:5lWEitWb+jTb2HRN7bb+Hj+R9ztPiLE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral23behavioral24
• • Target
    zh-Hans/UIAutomationTypes.resources.dll
  • Size 17KB
  • SHA256 4f630e05a68bdf5e0bb830a7f186dd8305c9693a57016dcfec173981677e55eb
  • MD5 53f28aa0ee8c9e79997452f4d5cef262
  • SHA1 68dfeec04a411e5a0ab091dc89d65df833af3c4c
  • SHA512 a64e897f085e196f1b7155249bb77a0cd07e03995061c30bd37009ed46d8997edee2643331451e18724644b902a3ebb8bdf7922048ee869851650d02e8c9a645
  • SSDEEP 192:nOtCxS22SOB4datnztWLWRBJpcuWXebPpUNTQHnhWgN7aIWkjjH+BEg7X01k9z3t:OtCxDunztWIBcTb2HRN7/sR9zrx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral25behavioral26
• • Target
    zh-Hans/WindowsBase.resources.dll
  • Size 77KB
  • SHA256 11765e2a7b3a3b424b99b45bd59c42ca976d29ed9f792d30e9b6bbd2f1d3fc5d
  • MD5 3e6bb2e889a2c1fcf08ab60c40772f77
  • SHA1 6cf8e65bb60b547a242b6048533ceae6b36fda1b
  • SHA512 fa3b68bd52a1c3c60e15f68b9e3be2f576f5997e315078073d0e7a07c58fb92b284b4f28581d094a9b73cf1d14fe057a89ee922048a83e4fa2d497939cf7ac37
  • SSDEEP 1536:7V+wjmTJyaQ4dPG8HTnhgMHgkwbcx8ma03BMLa6Y7lxnu4VPiShzUQ:77mTJyaQ7m6kwbY8mx/6Y7lxnu4VhhYQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral27behavioral28
• • Target
    zh-Hans/WindowsFormsIntegration.resources.dll
  • Size 15KB
  • SHA256 9387b4a9e6d8340fc12668f20118636c7a05334030c21cfee8ecd39f704fd1a8
  • MD5 0ca4233564dc1f5044e16c67f772cfdc
  • SHA1 0d914bb831a10e596a5a2f868a0fef922d9e4e16
  • SHA512 8cab430cfba6e2e5215ee013e57c30d271a467a06e3f0bb7bdddb964c8ed2b482d6741f0bec28004fb8c99a043bfc8c63f1e50e02e1ea77b083c35dbeb835db3
  • SSDEEP 384:TKtLFLHfFWq0tWSfNA5kHRN7AuxIUR9zD2:EZHfcqsTbxt9zK
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral29behavioral30
• • Target
    zh-Hant/Microsoft.VisualBasic.Forms.resources.dll
  • Size 24KB
  • SHA256 19ba34c438964a1fa27d120f5e5022a20501dd97074df4776f16815707ca00db
  • MD5 7921979c52c5c19fec0ba986727cf025
  • SHA1 956e88381c7a92a15f3a59a8fe0739e95922381a
  • SHA512 5a5d683cb7dd94ecc40d8a36a6c1de501456f4f10d9559787ac431ca0da7a5860487fd074125954019fed1c084ba8382e3181b826c416a06d8cff093b2099ea2
  • SSDEEP 384:HtyzKXSXRaRmInXdXxaxtSQuTmd21K/hCiy6lVgaWYHwhQ5WOW5kHRN7FsPI+R9q:NyzHIGtZa6w2VQ+/FBi9zENd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral31behavioral32