General

  • Target

    0518892b68d9401cee558e0615322ba2a902d759e36b315a55fe7238aff71d72

  • Size

    597KB

  • Sample

    240405-bfmm8sgd84

  • MD5

    d6abeeea631ceedc9704b11198ddb305

  • SHA1

    32c3d810eef2eefa3e317001657f6e5beb839080

  • SHA256

    0518892b68d9401cee558e0615322ba2a902d759e36b315a55fe7238aff71d72

  • SHA512

    b648a43f3fd6bf9c5594b8d0fa882eacd5714d2b69d295ef8c749ef5cae81846ed148034cc9cbc46912fdc959d83f4d9e9f822552f5ddba5a45c1d4e4150d876

  • SSDEEP

    12288:pjImsaOOmzPgf/zaUR58rAfTFIg4biQN9Az+I:pjqOmzIDaG58UfTFwnP

Score
10/10

Malware Config

Targets

    • Target

      0518892b68d9401cee558e0615322ba2a902d759e36b315a55fe7238aff71d72

    • Size

      597KB

    • MD5

      d6abeeea631ceedc9704b11198ddb305

    • SHA1

      32c3d810eef2eefa3e317001657f6e5beb839080

    • SHA256

      0518892b68d9401cee558e0615322ba2a902d759e36b315a55fe7238aff71d72

    • SHA512

      b648a43f3fd6bf9c5594b8d0fa882eacd5714d2b69d295ef8c749ef5cae81846ed148034cc9cbc46912fdc959d83f4d9e9f822552f5ddba5a45c1d4e4150d876

    • SSDEEP

      12288:pjImsaOOmzPgf/zaUR58rAfTFIg4biQN9Az+I:pjqOmzIDaG58UfTFwnP

    Score
    10/10
    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks