rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
FullSoftware(Package).rar
Size 70.1MB
Sample240712-rn77xaxcpm
SHA256 919bce39654fbf7c27b8ad159363fe0ec3f38690222cb9fa4374815a5dea7191
MD5 9f264d00a5685be555613dc56ea01055
SHA1 e8239dc6c6ae15e9f61b609d6d773b8907d0e950
SHA512 3d37ec13568239634baaa238a1de827ea7b681d97d056a0d936303a02166ae6dff7ae3d71dcacf648c3c6229628a82fce68bb4dd57901a19fce8b486fecef773
SSDEEP 1572864:FHvkwTMQNRJHAvwxTWS9KayH088kOsDRygVNxa+Wqh1l06XW5Hx:5vkwTMQNEkKQKaAj8kO+Vjag3l0hx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Serial Checker.bat
- Size 539B
- SHA256 036d1d1de2b2c68620345f56707219c793840fed9cc73bd7815dd310581b0d0e
- MD5 c618c11d31191de753c2bb7e22840289
- SHA1 2a2a3cc70a64d90f56df7041e16724ad069b4dcf
- SHA512 d2f158c2ca0b30892df4f72d4f7fc96c3e57e8a88c3831e6898af75de8bfd24515713afae18f457b95eebec8ad2be7a5b94553469a16dd36f56505adaf78299c
- MD5 SHA1 SHA512
Score

1^/10
behavioral1 behavioral2
- Target
  Sp00f(NEW)/Add/CiWinCng64.dll
- Size 3.3MB
- SHA256 c1596b987462edfcae5895d7dae2552e4cc737a2419da46c2e6911cc91b41c08
- MD5 cc9393adf63e1d1cb7ab6deb7fd73e1c
- SHA1 1f8386a6171fbf0f7721daf737bc812225da7800
- SHA512 04ac90229fc7e753054725bbdd78681415b39c146d65f50e656938c2c5a56420bf9ad8c384d482f5066d94932e1c4a745faa8fb506e6a43a088772dc91572631
- SSDEEP 49152:zfIU6iPVwASO8GtlqaHIPxy/iME+8fRFnuq2bG9G5XozWGmVXUK50TC6Zm+qbZKu:8+FPisw0VXUE0TLDv0zojYZ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  Sp00f(NEW)/Add/bdfilters.dll
- Size 4.1MB
- SHA256 9cbc29696ad2d582e251bf9c4be5cce618753fa43551d2474e1ae5cc5e1245e5
- MD5 ed730387fdcd684b756601b863c47417
- SHA1 c49ed6d0d46facf4ceaeb21f5d6bfdf9e3587fde
- SHA512 e32df727799d33922c6e92f94a7bdb0bc2772d6a6636d15e285d94d3ae4661062e5bc89ec3546b76ec853398f88d972f461327ef687f89093acf1096560d5c3f
- SSDEEP 98304:Xl4qYuQxqYfHYosUiJovT7DBmmhjSF5og3Vk9O0KChvvvveo:XuqYuQxqYfHYosUiJoviVKvvvvJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  Sp00f(NEW)/Add/bdfilters64.dll
- Size 4.6MB
- SHA256 008fababd36e8fbfd5f610a2c62d47963e78ec91e54ad69a1e20807445c3528d
- MD5 13f7a29baa1e04f74151737cb71bd0e5
- SHA1 0bc8682c6c96923a729aa6239aa53d95221b13ab
- SHA512 4cea11e88e8861c4094b227d85295c0d67452af703b0ec9dfe475797b87d03b40bc1f6b58dcc00996672c1c05d99b82dcc067bc429a1465ae90f4ec966f2bca8
- SSDEEP 49152:MQJ/D3PQxTTvfwBvvfrsdBD3PQxTTvfwBvvfrsdBD3PQxTTvfwBvvfrsdVDYPdxv:VJTjWDdLhiapD88SiQZsvvvvC
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7 behavioral8
- Target
  Sp00f(NEW)/Software_Setup.exe
- Size 63.9MB
- SHA256 ec4cd02feeae2e57341cb7ff396fac7d635c914775357b95a0ae3bb73ced8703
- MD5 9ff7e52416b7d3ca8b7e035d4b15f60d
- SHA1 ecf06e8679da62922f3d52d2b9e756ba311e4203
- SHA512 974b9d2d21ffc0d780fb5bb531db3f4edf979e032e2b0fa9048310885fa7cac06fc138b4aa5a9d6bb19a7fc7676c72e98a9ba9c60b35428a699774b34af474af
- SSDEEP 1572864:jDkFLa2/bDkFLa2/bDkFLa2/bDkFLa2/bDkFLa2/z:j6/6/6/6/6f
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

rhadamanthys stealer
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral10 behavioral9
- Target
  Sp00f(OLD)/SPOOFER HWID.dll
- Size 1.8MB
- SHA256 78854417b72ba57319c8fbd2b2b48eef2640f91e84256b85178ec20cd9d286fe
- MD5 f03e30cdd04b20ef28d3fa263aa2ab85
- SHA1 b78be1fa6a97899c7ecfee9cd3fa613b54902a72
- SHA512 fe9797708858ceec60e90f196c684c9d2ba42faceb3c0a3a3808c9734b9510f46ab25dcb7a75c63334f3d663a49a07afd10dc6fae288d6909309d16ce74a61b6
- SSDEEP 49152:mX/lx35IEurgBWBKH8jkDVFCNXODzWS9HfX0HIF:mX/LJIE3+KH4kpc+DX/0HIF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  Sp00f(OLD)/Spoofer_Old.exe
- Size 185KB
- SHA256 ed891bfe325c660e1ae96118cbad16e78077e437a58e2539bc237fb62f7cf5bf
- MD5 1d7aaa4cc1f653837aa4202d791ee4af
- SHA1 412e17cfbcb575b3cb3d4b0c711e6971043a6166
- SHA512 69fee1a92d2e6d9494a43132f62cae94774b05c7d6a6d3e889a23ed35b36930d28c66d2f8228678a7a42d10c3037b0323c268bc1cce8202fc28b05f2c6529971
- SSDEEP 3072:gczkitvo4BpYN/6mBPry8TXROLdW5m4mUR59OOGU0kNa/2udvhFU:gA4NCmBPry/N2lOO5fc
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  Sp00f(OLD)/runtimes/D3Dcompiler_47.dll
- Size 3.3MB
- SHA256 efbdbbcd0d954f8fdc53467de5d89ad525e4e4a9cfff8a15d07c6fdb350c407f
- MD5 c5b362bce86bb0ad3149c4540201331d
- SHA1 91bc4989345a4e26f06c0c781a21a27d4ee9bacd
- SHA512 82fa22f6509334a6a481b0731de1898aa70d2cf3a35f81c4a91fffe0f4c4dd727c8d6a238c778adc7678dfcf1bc81011a9eff2dee912e6b14f93ca3600d62ddd
- SSDEEP 49152:PyZ9lnpmVm/w+EwVOmufvkQS8MH2J9CqS5Sqr88pPWW5KhQYPsXqUiQ6:E9fWAwVBC8MH2JNSF8+YPsXqUT6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  Sp00f(OLD)/runtimes/bdfilters.dll
- Size 4.1MB
- SHA256 9cbc29696ad2d582e251bf9c4be5cce618753fa43551d2474e1ae5cc5e1245e5
- MD5 ed730387fdcd684b756601b863c47417
- SHA1 c49ed6d0d46facf4ceaeb21f5d6bfdf9e3587fde
- SHA512 e32df727799d33922c6e92f94a7bdb0bc2772d6a6636d15e285d94d3ae4661062e5bc89ec3546b76ec853398f88d972f461327ef687f89093acf1096560d5c3f
- SSDEEP 98304:Xl4qYuQxqYfHYosUiJovT7DBmmhjSF5og3Vk9O0KChvvvveo:XuqYuQxqYfHYosUiJoviVKvvvvJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  Sp00f(OLD)/runtimes/bdfilters64.dll
- Size 4.6MB
- SHA256 008fababd36e8fbfd5f610a2c62d47963e78ec91e54ad69a1e20807445c3528d
- MD5 13f7a29baa1e04f74151737cb71bd0e5
- SHA1 0bc8682c6c96923a729aa6239aa53d95221b13ab
- SHA512 4cea11e88e8861c4094b227d85295c0d67452af703b0ec9dfe475797b87d03b40bc1f6b58dcc00996672c1c05d99b82dcc067bc429a1465ae90f4ec966f2bca8
- SSDEEP 49152:MQJ/D3PQxTTvfwBvvfrsdBD3PQxTTvfwBvvfrsdBD3PQxTTvfwBvvfrsdVDYPdxv:VJTjWDdLhiapD88SiQZsvvvvC
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral19 behavioral20
- Target
  Sp00f(OLD)/runtimes/libcrypto-1_1.dll
- Size 2.4MB
- SHA256 fb5071bdfbfb59fb1102ed7c159edfb291e90d08c864ea4e372415192da19fc2
- MD5 0399619c3a5fe9ed498af787cdc10f15
- SHA1 23d7b48d4a99d18b3d6987b9ffd9ad5ff8f3498a
- SHA512 0dd63c0f54a7228b8641f7c0d33f8b7051315ea9da53f48ffc3c9ff78a43cb31406585962f0d31eef1f85013c50279c30efde41672e18794e723c37226eca44d
- SSDEEP 49152:1OP07cFnh1xocCIM0iZKtv0Zj852z1CPwDv3uFfJ10stT:1OP/450isaZj8Ez1CPwDv3uFfJ1
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral21 behavioral22
- Target
  Sp00f(OLD)/runtimes/win/lib/net6.0/System.Diagnostics.EventLog.Messages.dll
- Size 782KB
- SHA256 3a2ea792755bbe4674f349d7870aeb917494ac39f96a9e5d9625d4ac68dc3ec5
- MD5 286f0a973cf2332fbded81cf541fff06
- SHA1 c712b399a1e9217625cac0fa8dfab1c681eb5174
- SHA512 3b615c3071cf8c13e972391d53ad8310092d2503cd085334162cedcc141b1d25df2694b0034ca87d9dcab26acd69cbc3358deb7bac8a1ec24c142d39eb4e2ac5
- SSDEEP 192:knrMpXKRZwW+1OwvHnhWgN7aFWa8l98RjchC6zm60X01k9z3AifUX:erGKiXvHRN7b8RjcM6a1R9zDfe
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  Sp00f(OLD)/runtimes/win/lib/net6.0/System.Diagnostics.EventLog.dll
- Size 139KB
- SHA256 fac816ca0bd5d9c4a17693b37575a5aba901d993133b61d7344b597472fa0c26
- MD5 62c63c04c6083330d020cf855c85002c
- SHA1 abfd4f92b132ac47e9b049545be242f86f9a389e
- SHA512 afa4870e91b5528001b6a4019b068aacfcaa8040bb492c12b1dca9b0cd236d847b376d77b6222875eefe0ca377babaa541bfbb19f0165fc305775c36134a79a1
- SSDEEP 3072:PDIYZl6zdsy6PbTH2WAwPvXSMoiWJoQ46Kjbj4+:fZAGyoTH2yXSM4u1bD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  Sp00f(OLD)/runtimes/win/lib/net6.0/System.ServiceProcess.ServiceController.dll
- Size 66KB
- SHA256 d11b97c114101961bcc7acb0bb17e536708593c0321b6107942fba20cb430c65
- MD5 1c710ef8481e54352a4e1f66a8f7ad8c
- SHA1 ccd1388f0f418e7f74f10bad6f32c175b68e6880
- SHA512 f658e2a506e8c7a11a8e91ff069b63e84a1131742cd1928f2b9ca77e97ebbfdcf64b9452496f9e345a9fba70863ce3928fe6c5886a09f2c84682893ad4e1451d
- SSDEEP 1536:1zf8ajD3rRdO3OtMdq+K7j3RN0pmDf93zu:1zzD3116dq+K7jRNKmZa
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  Sp00f(OLD)/runtimes/win/lib/netcoreapp3.0/System.Runtime.WindowsRuntime.UI.Xaml.dll
- Size 39KB
- SHA256 884442e44bcef27d917e5de5b69cbd4a297830e0b98b84495c7ab7486fa47332
- MD5 7141c72e54fe9a7ed39ef89814de67d9
- SHA1 bccef028036224c6f0bb168d104d0f6adb186dc5
- SHA512 9d3a1da9f050dd7df26f3a35dcfef5766adf4d3627b9d28a57359414b1d67aee7a8b6176674a01a5a3b099e21be5ce9d3c911af42fe5150469e37ff8a92a7efb
- SSDEEP 768:XFUvumWzh6pCPtrpeHWGj45ZOo2HNB+LXDPp8vkyFww8L1v:XSIzDW2Gjjk7akyFwBxv
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  Sp00f(OLD)/runtimes/win/lib/netcoreapp3.0/System.Runtime.WindowsRuntime.dll
- Size 130KB
- SHA256 be26699765f700a29c3928e10f6d1e02a297dff3ba6eb7afb6ec41003cb3d665
- MD5 0198a79063c865ed21c95b7400ddd9fc
- SHA1 b56b4bc0760914149e8d43288d5c151b7fb8ab43
- SHA512 fa77da06a33ae646f69dcadeaeb71524a91cbdd1e9d8008c5fa278039bede09dab87b74765ff5fdf133a4f864d2a324659618d58a30e7dd165408b1c3be889ef
- SSDEEP 3072:zmhU+vMwoh1Zz+Wzvo3Z/O6ZFJX3JhKLqAOd:zgU+Ewmz+W7m/DFJXvKe
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Suspicious use of NtCreateUserProcessOtherParentProcess

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32