General
-
Target
c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a.lnk
-
Size
1KB
-
Sample
240419-ccfaesdd89
-
MD5
b6c511480d3c76834e42b773836e76a9
-
SHA1
f135c8ece764465c4e9ba8fded937f0ad4a5ab79
-
SHA256
c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a
-
SHA512
f11d8780b11eee262276b0f16b65504b1f1e31ba6a25bbf7af3577079121a94f17ddcfb49fdbda08ec3c438bf1b2faa10b49281d29168f0d541cef089558c18d
Static task
static1
Behavioral task
behavioral1
Sample
c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a.lnk
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a.lnk
Resource
win10v2004-20240412-en
Malware Config
Extracted
http://0had.com/stage
Extracted
http://0had.com/stage
Targets
-
-
Target
c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a.lnk
-
Size
1KB
-
MD5
b6c511480d3c76834e42b773836e76a9
-
SHA1
f135c8ece764465c4e9ba8fded937f0ad4a5ab79
-
SHA256
c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a
-
SHA512
f11d8780b11eee262276b0f16b65504b1f1e31ba6a25bbf7af3577079121a94f17ddcfb49fdbda08ec3c438bf1b2faa10b49281d29168f0d541cef089558c18d
Score10/10-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-