Overview

overview

10

Static

static

1

Factura_SA161.pdf.lnk

windows7-x64

10

Factura_SA161.pdf.lnk

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Factura_SA161.pdf.lnk

  • Size

    1KB

  • Sample

    240418-rbjc1sgb6z

  • MD5

    6b602c96ff01c4f55c7a625b2358a988

  • SHA1

    af42a6e2c1b97a958cf9e50a30cdf02221c07098

  • SHA256

    e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc

  • SHA512

    a793e118ba79adfe4370dd9a7f20dc90e64c3edc80a2f7fce052241c311e59fb15e71d4f1e38c60c9730cff6af9583c3fbcad9320f69968e8b90d7424036af95

Score
10/10
rhadamanthysstealer

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://93.190.140.76/factura

Extracted

Language
hta
Source
URLs
hta.dropper

http://93.190.140.76/factura

Targets

    • Target

      Factura_SA161.pdf.lnk

    • Size

      1KB

    • MD5

      6b602c96ff01c4f55c7a625b2358a988

    • SHA1

      af42a6e2c1b97a958cf9e50a30cdf02221c07098

    • SHA256

      e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc

    • SHA512

      a793e118ba79adfe4370dd9a7f20dc90e64c3edc80a2f7fce052241c311e59fb15e71d4f1e38c60c9730cff6af9583c3fbcad9320f69968e8b90d7424036af95

    Score
    10/10
    rhadamanthysstealer

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Process Discovery

1
T1057

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks