agenttesla | e7b7cc62dc6d8111922782cecb665e68a0574e19db3de5faa5b04d896dfbbad3

Sharing

Copy URL Twitter E-mail

General

Target
EclipseRAT.7z
Size 15.3MB
Sample240516-saw36aaa92
SHA256 e7b7cc62dc6d8111922782cecb665e68a0574e19db3de5faa5b04d896dfbbad3
MD5 8cdec702c27200704700afa2ba636d15
SHA1 df9d2cf6fb2c98475d820990f3f4e9f372f8cdcf
SHA512 5eb7aeff8250d8bdce93becddf9dec29618917aec841bb3c95ddfe1be115a667257b84b20c614037b191f6eb201be857dd076cc530d74c6e2007201144681d77
SSDEEP 393216:YkFoU/+gA2hcv0o8k4EdMoJpCGf2ABSuZffgbdlvC:Oc+QhoLM+pSAgu1fgZla
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

ps1.dropper
https://rentry.org/FUCKOFFNIGGA/raw

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://bitbucket.org/gedegrereghh/fuckyougithub/raw/37140025d15f5d49ec2bd023f7557f06268d7c49/pancake-unpacked.rar

Targets

- Target
  EclipseRAT/Andromeda.dll
- Size 43KB
- SHA256 f02f37555e44c069a2cecb6d82be1a3fcc54812e10bda8eea117bd2b7c226491
- MD5 bebcfac651d4d80b53b87108f40e4058
- SHA1 50cd4fd5c5ff864f2a1803d84f3329ceb693ef4a
- SHA512 addbf8f73caf270d901eed0372dc5c795fc9349662b841419912c7bdc400fce8b28d426d71fa9c73904b9acf94c526ae6c625ac107725894a5dfbd806d6e2e56
- SSDEEP 768:P1u+uKbhZVkik8UdnGVHfSXwBQ71R8hKHWgCJwuvIxAyYQAJU+ZS2SuS8SZS9ySN:PkVAav8WChZLU+j
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1
- Target
  EclipseRAT/Dynamitey.dll
- Size 164KB
- SHA256 db29f47dc1918253a36a09ff5804d14ddc81098ecf627e668ca617e3a0e2ab5e
- MD5 c5fa3518d32e1e5290113ac31f3bbc6d
- SHA1 3a735f84575d3e19408f2c0b60a032166cea51a7
- SHA512 c1c508a014501f558df21ca9bc063eee1aa117a9c34617e76d9cc88f7d2d1a348377446c1f997fdff3564fe1e1424f113e36f309822563cfa1b471eb4b909a9d
- SSDEEP 3072:RnLcuy9J8ZC/jpYZ0u+yegE1My1KnSe+Iev:pLcTJ8ZC/jp+09vG+Ie
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  EclipseRAT/EclipseRat.exe
- Size 7KB
- SHA256 31e6573e37d06a71b3025c0e9ed4901093ed5262bc60bbbdf7ce1ed28ebb021a
- MD5 960d70161f0ac1ddd8093955446bdcbc
- SHA1 5943c81939f9b43228e2fe2f65e90c54660ae47f
- SHA512 8f3f6091fb3d09d4cdb0f9540bbbc2de0562dd5bb77c8446db49f274be7b173cbc0aa24206e25838cc6b6c6578440c0ecfd1a17acc94c50ebd014cbe16617c14
- SSDEEP 192:+9yqvjp73xsznGjcJr9emxan6mUqlwc6nYZKvkV/9dXq:+9Jv1dOnGjcJrQmxan6m/ec6nYZSkV/2
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

rhadamanthys execution stealer
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Blocklisted process makes network request
- Executes dropped EXE
- Legitimate hosting services abused for malware hosting/C2
behavioral3
- Target
  EclipseRAT/FastColoredTextBox.dll
- Size 323KB
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4
- Target
  EclipseRAT/GMap.NET.Core.dll
- Size 2.9MB
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  EclipseRAT/GMap.NET.WindowsForms.dll
- Size 147KB
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  EclipseRAT/Guna.UI2.dll
- Size 1.9MB
- SHA256 952fa59d3d6d8c8c5fad8a1144e5effdf0fa92d58db1fb2a2899faf84c6273ab
- MD5 1915011997fdb9aa95f15e567f4e6070
- SHA1 40a7853f14d6d4919279965f026d57cf9a104998
- SHA512 5cca71b42ed9dc154e6d5919e7cd93046168781a55c051818157848efc918b2e4dd92f422eb1c47e0940b645ba750facf83bce240748a8170ac8ce0afc9efa90
- SSDEEP 24576:XJXD/hBn13g+Yi9oE7IYbO9ZY/NJdAjED+aE0qUaiIwpHQ/jz2Y:JTIYbGQdAjED+aE0LaiI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  EclipseRAT/IconExtractor.dll
- Size 10KB
- SHA256 2c359ce857982f45b09af49dbccfb2ae302839acf1956e8325e7f854b339a8c9
- MD5 7bcf61e29e5cbcd1b81d9ab72cbfed93
- SHA1 d082613177dd1711c18426d4f83921dd932bc7b1
- SHA512 ce84af38dc63374d304d4e3b6c098892588df5ca5e921505c410b2a24ec0137dbc3120bc713cc0e4bf7836c57b7db224dd3264ea454cbfdb1ef78c9ffb19b6d9
- SSDEEP 192:vyB0L3vIFktNlrgyLY5ZJeU5cs7hnvR952:vyeL3/gyLYPJR5RJG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  EclipseRAT/Microsoft.AspNetCore.Hosting.Server.Abstractions.dll
- Size 14KB
- SHA256 dc55b200190e101780720ea8c8d3b53f2b5653ebe6f0e0676f1b64595ba9d132
- MD5 4d9d797c82b0af93625718ca9012c17a
- SHA1 910eee42753057e3e1849391e5fd4746c1f876b3
- SHA512 3c812b52c00e8771849d991f8a518a0af4ad3b52332c86078a3de08077625784804ff0fd95bf568743f06cd4b26ec3b7634eb02b1aefa2394a8dfcd21dd4c369
- SSDEEP 192:RaH+I0E34OcCA8zWh6LWTWv14UgLaDyuHnhWgN7aMW2aoinEqnajxFiIi:c0W4OcD8zWh6LW+c4HRN7B+ElbiIi
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  EclipseRAT/Microsoft.AspNetCore.Http.Features.dll
- Size 31KB
- SHA256 276c50519e010fab6cad092f192e470d07e44c633399a4bbe9303d9c9aed0a98
- MD5 2cc772c2e93d19e28098e17a6a6eb03d
- SHA1 790b8f91cf0688b92152112305b9c076ccb7d889
- SHA512 980eac653eaf674310b9ce543bfc967deca56b3ed47b917e4916e7a7eed13584e05deaa5639c2f3eb6e0671c2795e6948d1a22adca1d8aaecbe77696aa2088a3
- SSDEEP 384:T3IDcGf5H2ZZ6X8P1Z4MPbguVJNMU0Ecd1z2jzJNStRm2ioTTNzMSbWlzWX+VkWY:bIDcUH2ZRXPsaS3JiANzzbWzIBNnD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  EclipseRAT/Microsoft.Extensions.Configuration.Abstractions.dll
- Size 20KB
- SHA256 32ccdb2ab4348f195d247f920d1432c0cbb1cc5fd548fec8ee562c438aa48849
- MD5 d8e064ad8f2419f204723cf7caa7ab0b
- SHA1 f19f20d758dae8563fc4914c737e06f1292f58e2
- SHA512 b2ed620bc914433435e655f7a1c956735f959c3e8c60a182d96ab0a59a54c81ffa0c52214d88c6e48ca82e198ad7e9fcb603d6dc017ec64399fcf40d3178c341
- SSDEEP 384:0aEsyjAb8TG/ZvozRjz6r5c3JABzWSPTWC4c4HRN7+eRl3t3MmW:0b/Q4JApaB+eKJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  EclipseRAT/Microsoft.Extensions.Primitives.dll
- Size 35KB
- SHA256 42bbc209a1a39f3bab6652478de1bc7dd240146e3b668d34253425eb663bcc4f
- MD5 30f911d2ff61105f7b5680006a9e4def
- SHA1 12285ffda48a642f3b06b06ce73f79341475c006
- SHA512 bcc6e1b979a370d1e11083327776364620e7055cf21d05f56f5867839de77c5c3823bd1adf123865533263fe7766a6fde6e66a55535c705a9097662e1181d463
- SSDEEP 768:HOBVTHyqXeGfbUnEsxaWYUeIBuiglpTcZZzBqyVO:HOvdXNN4aLUrBuiwi/zBqyVO
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  EclipseRAT/Microsoft.Threading.Tasks.Extensions.Desktop.dll
- Size 46KB
- SHA256 f71621c47c610e0886846cf53d955fd0e7448951f99ecc22facd47493ef97a87
- MD5 e548a93d16964e52868c47cef1c98f2e
- SHA1 4b96b0aa48f6ac050a764c7d65f4129a9bb8cf21
- SHA512 fd1377b5d2d792eccf2ab9a01529838f178126fd6748da8e27cbc908ea83813fb4de021aa88989186459fef1c11be76aaf8b29b2291203d5f34f98361acf77ab
- SSDEEP 768:bsoKLggFUyETHj0Y5m64r+B6yP5wwWGZ8iJvHWrI:DKUgSyyD0Y5tVwwlZ8AWrI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  EclipseRAT/Microsoft.Threading.Tasks.Extensions.dll
- Size 30KB
- SHA256 92f1d0d6ccfb0d030789f3c5c636fcdd08f6d0541a5a54f185e8ecd85592e3f9
- MD5 6aa2393ff1fde1a61d0cf51730428f74
- SHA1 3c847a95a6547aa49919789d7a0cb6ed76122849
- SHA512 1af984ec56885cdea9a0e379d659b65196713571377e2db267259dbc1f8748f1a610b0183a8fea3730f0049c3468f632240475730563c6413cbc88cc76032d91
- SSDEEP 384:5qL9uaxv+fg8SA4nrzrRzoGbSOW12nWH1q//0GftpBjHoH3HRN78xLsltr/wn:+MfmrRzZ+QD8idoH5r
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14
- Target
  EclipseRAT/Microsoft.Threading.Tasks.dll
- Size 36KB
- SHA256 5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
- MD5 d01819bfe03222dfa9e35a36555b6b6c
- SHA1 25f8069590b14724f28e6a04b8a42e4ef4a8562d
- SHA512 e63901f39315972e446768f2c14b4279cf1dd382f97ac90c444c4d858c2a486736a259c47245026b11e5c0846310e7da020bf2466ea91aa0a15d22cb67b37477
- SSDEEP 384:AjCan21RTf1FuPIgbSVHfiWvoVZHL+8SChE+QNEv4USWyWcWZ1q//0GftpBjfuHk:A+e21RTrgbSpfihdvF4eg8iUHWTmlr+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  EclipseRAT/Microsoft.Win32.Registry.dll
- Size 22KB
- SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
- MD5 da40f3db8b34571684c0cb5bcecd2a79
- SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
- SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
- SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16
- Target
  EclipseRAT/NAudio.Asio.dll
- Size 33KB
- SHA256 5e87935c813b7f92d358871541636918010b46384cda03a82872d5a7e95af8ad
- MD5 eca1fcebac1d36048548f0fa78ea1f00
- SHA1 ad561ec8945ce320b766f1792335969838ac1820
- SHA512 c0fdf1fbcda213b4c01e9bbf5caac2bca37a9481f1992f2cc2d5a182ceb9e2177d99bd8695583947125fff47f9d2327afe96aaa65bb4b53dd935a8d4774ba819
- SSDEEP 768:XehRrWpB5henv0HTYdpVCYKo9coe6ttHjB4L:XehRr68847UGtHF0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17
- Target
  EclipseRAT/NAudio.Core.dll
- Size 184KB
- SHA256 f297e28c7061e4294fc65a6be1629d951b0496950f0060c919fd9f305f27aa91
- MD5 306981c15e48a97621111055af6c80e0
- SHA1 02bb965bb2a8a4150461221d06f0f1cdb68b38a9
- SHA512 b14739f7cffe09b8bad2ba88c531bc3f8e00f9a4e8ab7cf5fd9db8b10bbdca391437e3f02a1d67c315ebb276329755fb8d7bab5d41ed3482d35688be0bc21ce5
- SSDEEP 3072:Fw75DbLDpM5qqDxNUZlg8hPaYnQvmPtG5EC1f+xVROY1kquSYsM+S7UV:etbLDpyTDxNUZlzaVmc5ECkVR7mfQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18
- Target
  EclipseRAT/NAudio.Midi.dll
- Size 45KB
- SHA256 0e2b59a26a3432dcc7105011809ea428d11ae06046c64dcfe4772683ffeeac99
- MD5 a25633defc5ae2e967d6933337ecb18b
- SHA1 8335ed274a36a6048c85aa7d518feb833d594d7e
- SHA512 8036eaf59c1cf93e3b9114c8871fb9f04a96a4a90f7f61886b6b30c102590beb6b2115292d472359479f3676c83abfb78bd272213888e838433b017f970acf2d
- SSDEEP 768:CwWDUSfzw3fpAU/rEC9iLAOQKKdMsMNjxhJUsVyae9iWvmYRMUQ6LUqu5/EAS7Bs:CwWDUuzwiU/gC9GAO7KdMsMNd3ve9lvg
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19
- Target
  EclipseRAT/NAudio.Wasapi.dll
- Size 169KB
- SHA256 c25e5c0694dc709c72fe01182db5ccfea9229f65bc7deaa9b0298234c84a8fc8
- MD5 cefea34e55fa19e89eff8460475af986
- SHA1 5870f8ec79819fed7a8980f4f4e9f5e4a106dd70
- SHA512 9cf220b2692209bc5940e895cba5ce4f1521e66d2e116620db022af2689efd41050d2b5df2ed7cf2cddb034ae4615d0243a85c2ab54e835e279053f5fc8b2bed
- SSDEEP 3072:yLGThp5D8DsebSl0UAnbfqXlA4DokMu9Sp5KjyPIVpFL02bXEA:yLGTP5D8DJbSl0UAbfqXcoslIZb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20
- Target
  EclipseRAT/NAudio.WinForms.dll
- Size 40KB
- SHA256 7d990e527ed479f8d2a0c808bd769b7b2e03acd0693ac4e0e8843dc239189adf
- MD5 c637600f25fce3c3999a76dd7d8bb863
- SHA1 553466c88f0726019e0f427889984c7de5cc5994
- SHA512 eb98cef0fd0dec2bd48158def591e7b387c457c1287a284b9548092bbe2536c849fe1d71db51b4390efdf0a0a6040cd1a72e02deee6e58d053e64553e63f808e
- SSDEEP 768:8NMJ4j7TupqLq+VHDvtiT8dD9WCPRtbQDmZ1RCT+JjQ2fPj9N2fo:6uiqP8dRWMzbQDmPf
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21
- Target
  EclipseRAT/NAudio.WinMM.dll
- Size 56KB
- SHA256 33f702554e65eb282cefd6b185ffffe5da3a366af83ba0315535ab4fcfb3291c
- MD5 b573987e03c15ef1de5574e3c12bf651
- SHA1 d9ba799313d4839e7eb321ffbb202a9a1cb37f15
- SHA512 0ea9606f859f75643a99072f3223d08780899ecb25d9583c41f50eef900de0c319c16d5eb9dc9e4c0aa24a2b207e73e5b113c23cc227b4412ac67b31d112a4cb
- SSDEEP 768:XQFu51JOtZiWr3CJBTNgUEXahPrDVSve+u1tgMgGd8GbpDrXa8Rcer+7Bj:XQ8zrWr3CJZNGahP9Sv1u1tgufpDuPj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22
- Target
  EclipseRAT/NAudio.dll
- Size 7KB
- SHA256 797afeb19ec991ec660dcd20b367156fae63f9e491d5e3e40ae74d77dd5a4bd4
- MD5 6e654bbde745769e65072b5472b502b2
- SHA1 99091366d6bec66a34fbeeeb114e0f8af11db19e
- SHA512 027af0a708f34eacd7e69f7333d46a14d18b31af845fceffe390af6c8d44de690b85d6265b7cd89aa1b9f5a19461722f6685774da57157f3f2aa33beaa1e9d46
- SSDEEP 96:BBFskeJHn4jZkcLqEm5ND7AVUhkon1MrtrRGP5pkQcQDSd2E:B7kHn4kcLaD7zSon1MRljQcQDSr
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23
- Target
  EclipseRAT/Newtonsoft.Json.dll
- Size 490KB
- SHA256 0edfac6be11732ddd99db66821ee47408c2dc1e9bed68e5ef9a8e130c565b79b
- MD5 cbd6029abaa8e977d3b7435c6f70dd0e
- SHA1 ebb89d4d7659ef77b658a86ad00dba0ead869f4c
- SHA512 96754c8a846311ca59f8ec38185c2a204017bc8bc73bae1fdee63b66f3cc459017ed34ca164b53d625abfae683683b278e1aaa66346023018411ae70fe9e8059
- SSDEEP 6144:EUjGZDUI+aj1pJcggovoff4dCWycRrMikC7qEACBdr0tqngai0p7eofLPsT:xz8Dbvon4dnkKd7Q0nyofLP
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24
- Target
  EclipseRAT/SimpleObfuscator.dll
- Size 1.4MB
- SHA256 b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c
- MD5 9043d712208178c33ba8e942834ce457
- SHA1 e0fa5c730bf127a33348f5d2a5673260ae3719d1
- SHA512 dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65
- SSDEEP 24576:FDy7cKOfkiRrXP5WtJvW1mpjSWr7uoZme1V86:+8/AtJes1LJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25
- Target
  EclipseRAT/System.Buffers.dll
- Size 27KB
- SHA256 9444b5a41a816b193c033bec199d74cdfc8298ed8300a3c39a4e953dec137494
- MD5 b66c85efa4d6f8c698476735c1ff4ecc
- SHA1 e523519ece3200133c5077993920d14d436b8484
- SHA512 7a648b004c49074c557624254bfc5072e10b8094e49102d91406bcbac30d78293c84b8bbb4e0a522ffebb873ae4d47ce2a2888c0d858d6e3e5ffd1d1066933d4
- SSDEEP 384:HICREYcfpyXOT9Z7a6WmYWXXC77q0GftpBjmfFxT4bHRN7jzlxRx6:HIiE9QXM1KiC6bV8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral26
- Target
  EclipseRAT/System.Memory.dll
- Size 145KB
- SHA256 63cca774a231ed2f7ca888b4b6c6d2357cb4848aa3040b2f0e67430158c21ed2
- MD5 89ec6e101de3a70ed140c62c2980f24e
- SHA1 f5e64ed69c1845556038d70f88a081a92f7ea4a6
- SHA512 8af03e678ca0047e481a76a383e75c11e9474b032db4adbc7e89adff62449bd0067801a8f4a0f5d47fabafbff319d69f5d5dbdaf0d0689025490e787e7138c22
- SSDEEP 1536:7xi8ae06y7Q0kSutmvEmFk0pBa/+h8k/6nY2F85bmhqABtl5ys1G5aVxu3c0:d0vDkSutmhFyYqA6qAVTk5SxH0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27
- Target
  EclipseRAT/System.Net.Http.Extensions.dll
- Size 21KB
- SHA256 9c0bddab3c67c22716b63dd16c0ae86706ee6bbd12b66d357b9096dacc4e5917
- MD5 c070eb8eb6cac283fae57164638f9cc9
- SHA1 0dc661a49aa6a3ec69f95973a62fbc2379d35dee
- SHA512 22ba4fc9057f3c9ff59b4352dcd0eba55f67848b31337f31b0cd7da0a2f3d5b7e170f885ad519b03a0827f6863ad10411cf7200c9c5949e5d743b7086df0dda3
- SSDEEP 384:MCOi8W3Bo530GftpBjcuH3HRN726lFfQKn:ntBri2uH2MYKn
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral28
- Target
  EclipseRAT/System.Net.Http.Primitives.dll
- Size 21KB
- SHA256 380b2e298165798db42368d066c3049c2dd8c3d3eaf1425c6a86b3647ba2b577
- MD5 c84e8005accc371bea6dd9a91ace0549
- SHA1 e98c9b6c59aa2a58611679a6c220b9edece9199c
- SHA512 b4aa79fd29a3f45078904d5c3f3f8ad8130bb9705be6224054935ad982e2da36411796a893e3f749e343756091dca1d488930ec51a30cec77f55878ab810c9f6
- SSDEEP 384:DVGy/WBbw/zX0GftpBjKkH3HRN7oSlVel:5xmZigkHowC
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29
- Target
  EclipseRAT/System.Numerics.Vectors.dll
- Size 113KB
- SHA256 a044d77edb6e8db4053bf67cc671e7687c226c1b9b0963a81ebe359ce79dfdf7
- MD5 482d88247171630099d81400dc0a1aa7
- SHA1 359f9f8a3e0ee63f9eb6bc56e3bac300c731c080
- SHA512 b14d84f24842669a09054a30e97927a02de2d113319fa80246506ec0ba9dd51d22f87a35ec7a8bbd145921acfee26a06db0006ce93fab0e108dcedff1ec3d8b0
- SSDEEP 1536:xpKSyD3hoE3PQU9xb1iPKHKWU//6hE2rkQQt1vOTbbe:6SyLhZ/X9xb1YKqn/unQPvOTX
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral30
- Target
  EclipseRAT/System.Runtime.CompilerServices.Unsafe.dll
- Size 21KB
- SHA256 bac58578ec05ecb8c234bf3402a0aa1491a5e437b03008b431e78d663ab52b78
- MD5 0f362259a185486a72628244b6a09a90
- SHA1 e52460151a5a144ffee9a4d72ec3d5d5f3ffb474
- SHA512 4b03c8a696d01776ca942a04412a4f215def4bf7532f1c2954fcbfbeb98ac1cd0779550d3543835f0942101acfce639faa8986b5df1c1f9446944f1e686e9098
- SSDEEP 384:ISOOdUvT1Dm0GftpBjAaQHRN7EVQZlcoXuLv:I+21DViuLc3IuLv
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31
- Target
  EclipseRAT/System.Security.AccessControl.dll
- Size 30KB
- SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
- MD5 2d3e0b4ddf8628b41057b2aceef296eb
- SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
- SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
- SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess

Blocklisted process makes network request

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32