Overview

overview

10

Static

static

3

RPack-Laun...90.exe

windows10-1703-x64

10

g2m.dll

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    RPack-LauncherV.28.832.2431.zip
  • Size 11.1MB
  • Sample240508-ft9gdafa67
  • SHA256 739390602ee64e0c6fc696e569f5e1672f24e7c75bd07c86e5b68ede56366fda
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
rhadamanthyspersistencestealer

Malware Config

Targets

    • Target
      RPack-LauncherV.62.100.3290.exe
    • Size 31KB
    • SHA256 a73709c1b5f1f875ee35f477c4e263a57050c36e2cff31ad1ceca17d9623e7cd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    rhadamanthyspersistencestealer

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral1
    • Target
      g2m.dll
    • Size 29.7MB
    • SHA256 85294150b7e0b83c6e6517d22bfd4af2376dcdc7eea18b4bbc263453e2d8bba2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    rhadamanthyspersistencestealer

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Adds Run key to start application

      persistence

    • Suspicious use of NtCreateThreadExHideFromDebugger

    behavioral2

MITRE ATT&CK Enterprise v15

Tasks