General
-
Target
sample
-
Size
31KB
-
Sample
240521-ynezpagf56
-
MD5
e27e172a8e80e62005a29cdc12d71c5a
-
SHA1
d9c361abfaec30bff360f6c4a3fc2af70f01e2f8
-
SHA256
40654752138655a2f2fc6c9107fefb2f840d89b5d2d2f59941d21ea119cecbcf
-
SHA512
ffe236fbca3f537b3a81861332620aa523b039111c49730b1ef23f1920e07cac4f9e8046b6b87ba23246628d9de036bf5e1c1c4e7ee52858132708365a8a5bcd
-
SSDEEP
384:nH0edPP0ucjdey1YKfPn5TP3QQBtiUEzVjWWAoP6J94XyTKbPV6+xxdPP0ucjdeO:nGZv3xBtiUERjWt4mqyTKRzqZbmXml
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win10v2004-20240508-en
Malware Config
Extracted
lumma
https://babycandidateoswp.shop/api
https://museumtespaceorsp.shop/api
https://buttockdecarderwiso.shop/api
https://averageaattractiionsl.shop/api
https://femininiespywageg.shop/api
https://employhabragaomlsp.shop/api
https://stalfbaclcalorieeis.shop/api
https://civilianurinedtsraov.shop/api
https://roomabolishsnifftwk.shop/api
Targets
-
-
Target
sample
-
Size
31KB
-
MD5
e27e172a8e80e62005a29cdc12d71c5a
-
SHA1
d9c361abfaec30bff360f6c4a3fc2af70f01e2f8
-
SHA256
40654752138655a2f2fc6c9107fefb2f840d89b5d2d2f59941d21ea119cecbcf
-
SHA512
ffe236fbca3f537b3a81861332620aa523b039111c49730b1ef23f1920e07cac4f9e8046b6b87ba23246628d9de036bf5e1c1c4e7ee52858132708365a8a5bcd
-
SSDEEP
384:nH0edPP0ucjdey1YKfPn5TP3QQBtiUEzVjWWAoP6J94XyTKbPV6+xxdPP0ucjdeO:nGZv3xBtiUERjWt4mqyTKRzqZbmXml
Score10/10-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-