rhadamanthys | 1b34123865299a1e0d24154ab28c38232224ffdd3b6a73d1c803348483679108 | Triage

Sharing

General

Target

setup.exe.vir
Size

5.4MB
Sample

240703-p5386swflg
MD5

034cb49ca8d26a8ff881a093a3a1840e
SHA1

eb831c3938d4343379af9787e063673fa957dd2b
SHA256

1b34123865299a1e0d24154ab28c38232224ffdd3b6a73d1c803348483679108
SHA512

77b102464f7a5c0bd3085362ec872fc02b04954366b4d00a63410cef67116fe1ae960bd93edb7b298dba3979b780a9d8d980a282eb2c6fad55d77c39c244b286
SSDEEP

98304:fq4qkxXgnZDkE3DsMCUrUSGgykKoDJkrht130JADnKf53eooUALG5:ygX0gYsMVVGHoDa713+InKkooUMO

Score

10^/10

rhadamanthys risepro evasion spyware stealer

Malware Config

Targets

- Target
  
  setup.exe.vir
- Size
  
  5.4MB
- MD5
  
  034cb49ca8d26a8ff881a093a3a1840e
- SHA1
  
  eb831c3938d4343379af9787e063673fa957dd2b
- SHA256
  
  1b34123865299a1e0d24154ab28c38232224ffdd3b6a73d1c803348483679108
- SHA512
  
  77b102464f7a5c0bd3085362ec872fc02b04954366b4d00a63410cef67116fe1ae960bd93edb7b298dba3979b780a9d8d980a282eb2c6fad55d77c39c244b286
- SSDEEP
  
  98304:fq4qkxXgnZDkE3DsMCUrUSGgykKoDJkrht130JADnKf53eooUALG5:ygX0gYsMVVGHoDa713+InKkooUMO
Score

10^/10

risepro evasion stealer rhadamanthys spyware
- Modifies firewall policy service
  evasion
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Process Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

riseproevasionstealer

behavioral2

rhadamanthysriseproevasionspywarestealer