rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
LoaderV4.5.zip
Size 15.6MB
Sample240718-m5keysvgpl
SHA256 eeed7afd78dddae6f6c222b955fa1ca656b48fa2e04f87db11092dc87d2c86ee
MD5 a74803eb00543ff67aa80c08d99bf541
SHA1 ec3edafd0434e744779a5d47dc905ea63c4dab79
SHA512 9d92a3c71ab8b48f91db5cd0d05e4b171b7d00451916b808eb3a6d381fa0eb98fa38aac9b19042a5910801051af4dadddd10510da5a3fe657aae7f12207e3aa4
SSDEEP 393216:WvidJWySZDG3y3gk4AZe5L4uXoX0jFtN28f968or:WaQyEDGi3gkRe5LRX8gG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  LoaderV4.5.zip
- Size 15.6MB
- SHA256 eeed7afd78dddae6f6c222b955fa1ca656b48fa2e04f87db11092dc87d2c86ee
- MD5 a74803eb00543ff67aa80c08d99bf541
- SHA1 ec3edafd0434e744779a5d47dc905ea63c4dab79
- SHA512 9d92a3c71ab8b48f91db5cd0d05e4b171b7d00451916b808eb3a6d381fa0eb98fa38aac9b19042a5910801051af4dadddd10510da5a3fe657aae7f12207e3aa4
- SSDEEP 393216:WvidJWySZDG3y3gk4AZe5L4uXoX0jFtN28f968or:WaQyEDGi3gkRe5LRX8gG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1
- Target
  LoaderV4.4/PhysX.NVX
- Size 21KB
- SHA256 abc4eb7e89a5f94f67ab40b7a8adb4bf9cb4900ddfdeb54bcdf5eb0e1c478b2d
- MD5 af726aff05a26badd36c25dc476e7a0e
- SHA1 13d7b19ada73fbcf082f5f2f7fbc6fd468585dd4
- SHA512 7f434eb1a5edabcf47cf7b6b7d6afeaf96a3ee85dab92ec9e4c4899c3c3a5d989e6486046b3376fb4ffc524ab324954bbca36c9bcaa7bab4bc3223faaf491e8e
- SSDEEP 384:U76oReNii9P2CLcmgigmJPC2KfuGIf0NNfhHk0fIx7fnCGfSRlFf58Xf7Glx6Cx7:U76oReNii9P2ComgigkC2Kf9IfMNftkW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  LoaderV4.4/PhysX.nvi
- Size 35KB
- SHA256 f2d55232e244cfbf0c6ad3d062a3466dca57ace0d03bb8f590f94143051a9e10
- MD5 890542cc8613560c5e6431e53ffd5c02
- SHA1 da954ce5ccd4c2ca9440b67cdc047d65b09067be
- SHA512 2b8b0bb4d8d6b0b20ac457e9502f1e6b7a103929cbb7ea67f3017ee710d9562268f7f9b274cdfa52aafbb0bd6e8d355f419555643cdb288812b1a36529de51ba
- SSDEEP 768:xZ2czpU3IcdcC6tW3M3sFzxZhB6CW+WOF9WuBpsuz9hiaXPsYlRocSOUSjRA05Js:P2c9XcdaFsFzxZhB6CW+WOF9WuBpsuzS
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3
- Target
  LoaderV4.4/PhysxExt.dll
- Size 2.9MB
- SHA256 224ba9fe747ed7266a392961586db8a716553b85760fe3083e6d345034868d8f
- MD5 6ff985653d41e8d60bb1293f01729adf
- SHA1 1ae3086a16a91ea45c06d34071d8b3b87e058804
- SHA512 fd47a81000dcd98adc03d1f45a172c19b2e8aa3c8f13338bda0b00407f7b81b52e0fa9be3f9ef87fb1303231225e83b9dd8c39a0777ee56ccd54abc52d095b87
- SSDEEP 24576:fZJJSVBjkvvhwVxKKpQgRQ8sUOwDUsHeHfcKtaPRO/o5o4Z/5rLyv+Fe:xJegvvhTKTRcPDqho4F5rLyW4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4
- Target
  LoaderV4.4/Read it to me.txt
- Size 637B
- SHA256 ab1efb123feeac5171f3613e694d81277d43a74554e943c1619a1e32cd8de16f
- MD5 63039ea52b96b6c0354eca7196c1c93f
- SHA1 76b013def08a47c2b9cdddd9c991b4c9cc7fcb73
- SHA512 04b7c81882802c0573640c3462256ffc62603fd49f84ca4cff01ed8bf05d5e90f19a3b5bd09b2c2d896f6eaa01d46e8a9dd5a5ba58d5c1f4e446b2afc49cf9f5
- MD5 SHA1 SHA512
Score

3^/10
behavioral5
- Target
  LoaderV4.4/V4.4/0000.ui.forms
- Size 60KB
- SHA256 44783c068e6d2b30190006225d2bc586a98096d56f41f78e348bbae828cdbcc8
- MD5 a68a506afcfd78b3186b586c0bb17211
- SHA1 69107a6f6aaf8613b84b2ae55d932d48d7d29e1b
- SHA512 7e8eb1643f670772a7ce1a42910847bc8133f463adee428987934110cf2225954b4c8586890e0ebc6d894c406bc5b61fe430c63b67ded4765017186119aed75c
- SSDEEP 384:jvaw5hUay8ncuNkctpoEcQNmcvZnMmGX0aP5fbU8oUjoJUmoJ5UCoJ5+UgoJ5+tt:EsY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  LoaderV4.4/V4.4/0000.ui.strings
- Size 1KB
- SHA256 e792f8a6666c05d723d9c19325aa3429e35df36a72cc4c229dc2cef0876de79d
- MD5 88b402cd5cf6c9145b6c9aba0de7fc20
- SHA1 71fa5024b381cf06c60874e41b7d42c263441f3d
- SHA512 579e7227c721d19ec5e52ee37bd7fad0cacd96e8f898bb6cf26063c4fedadf8c78781b11285e8e1d25263277b3b069b5df182158123655b74de4216d69e97ee8
- MD5 SHA1 SHA512
Score

1^/10
behavioral7
- Target
  LoaderV4.4/V4.4/040a.ui.forms
- Size 5KB
- SHA256 cd9bbb99b5297e0eb206c46c3a49906cdc20dcbdb03f3ef4759a73016ae52d1e
- MD5 e3b162ccf4980ed314d76914eab0b152
- SHA1 adc8342dc84135f1807a22f5b4e6de61dc1872ee
- SHA512 d3601a24ae10f2050e39ee10a1457547e3bf8dd5cbf9360f6b5dbbe624c0d6d94f2e2ad2656e550405386ef039ceb54d5038b635dbf7aefa4b990db1f4a33b95
- SSDEEP 96:SULx2rCiVffJIJxhMzguLWv1Nf5V5q0vgZfNsZ77rhm4zXjZHPxfbfPHDl:SULx2rCiVffJBzguLWv1l5V5q0vgZfNm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  LoaderV4.4/V4.4/040a.ui.strings
- Size 10KB
- SHA256 f1c701b8c4ab9ddbcc8d46084c4a20d4aa64bf3f2cf42afdd1010efe8d147f66
- MD5 b7d997d903869b30f78543142c8b890d
- SHA1 807840d713964e8029e3aa9b07b3626ce785b004
- SHA512 0440dd5ef3c4a5ee07b7e08ed9a9eb12ce55c7bbdd89c471cffea216970f2716a222934ea34daeda821e48a46652003a824d66d434f1071c122d296294ca59ef
- SSDEEP 96:qumjfCmD7DLbW5EuivbhMrJHIXEafqnbgKuWILGYZXZ7IcO2OOD:FmzCgbW5svbSFoXEtbQVZJ7IcOtOD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  LoaderV4.4/V4.4/040b.ui.forms
- Size 5KB
- SHA256 71c4ea69fd7e0fc130b8dad26bc46aa63ad465a3faae99ad2a280d50f668505d
- MD5 400acc3967c50f2d904ce98095bce251
- SHA1 411b8a9bab5d161bbedfad69c35d6ed109718177
- SHA512 2a89dddcee340b07a478c508bee153223f367e7ecdc69d4462f2c0bc20c4580c5cfb5ebaebb26de3af6de9b7b3bcf202cdc04605de738dcb7f479fc5465a5e4d
- SSDEEP 48:cYxlBnrC7mJzffJOLn6fe8FsF4CyCLfASCELfQi29MMM9zv66fJIVqnIY7nIYPnK:NxrrCiVffJS+3KT3PLp73g
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  LoaderV4.4/V4.4/040b.ui.strings
- Size 9KB
- SHA256 3d1600a1e73b56fc03b16c359441468a3c2f4f4771174caab3ddc85039f1b7b6
- MD5 0a88f842daa2de8b94aa099d81e23d17
- SHA1 206210e83092544fc570f029e3113d96b0450b24
- SHA512 4bfbe8ef4bf073ac8dc995a09c638fa5ace4da6675d407ed0a86d5109ae3af279bd051d67b1ea934b59420ecf2b2e49f9d7531a685d076d255fba3327be5009f
- SSDEEP 192:hhnrV//tZzaicy9ZRq0G8QnAjaQvFmEDARpkakYgws90crBOdrOD:FFKy9ZRGtAjwR6H
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  LoaderV4.4/V4.4/040c.ui.forms
- Size 6KB
- SHA256 30acca5d175cb03d3acf39482eba243012870d072ac634226fbdcb8dfc5d1dc0
- MD5 192b2471d4913ef18d648890a98207d3
- SHA1 3836e7833745ee2b5fea372b73132303eae54e62
- SHA512 5f6e631d00d4fd1f0613be323879ca1bd79e468f03baf3b1460c33dd4a19ca2a1e97d0d10f1476486b3f2c4e0093d2f02b4507b51cb8b73b0e19e07d754176d3
- SSDEEP 96:9xMrCiVffJOaGp1Ic1TTz9lELR/RbRVR5M4YP:9xMrCiVffJDvVxzEP
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  LoaderV4.4/V4.4/040c.ui.strings
- Size 10KB
- SHA256 015b2337f6348ec810bdf06a68759dab7c1fc0543421784fdb956b1b3e27e5fe
- MD5 4a1993ac83570268ae11ee1879263a19
- SHA1 42adef3ddf560fe8f4387a040d092fb1b4c84033
- SHA512 f0ba640f1ec036d6ef1ea8954df7b04e920ff207d87cb11c134a50b9842709f5da0f30b3e257e9df99138861567f586567c638bb89057cca0e317e452c4be0d4
- SSDEEP 192:TMYp4g5z9WkoTmvlkzLMjQXE2fs8gdOlOD:gqrWkIm2Lc1
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  LoaderV4.4/V4.4/040d.ui.forms
- Size 4KB
- SHA256 4c6e5568e57ee199f924ca008cc9708d657db81f36eba379115e311fbf42d6a5
- MD5 a2ebb9e8f6bf8db4f47bd69578283532
- SHA1 c8784a4a2f21ee001dd0ca11cdd1dcb6a1995ea5
- SHA512 8625718c0ef01cfb4d78adef0d9dbf2f30e1d1f1a95945061dd4a868080908dca255108bb350c06793504a7fcbae18ffde4525d86b673397269911a4e77cfb14
- SSDEEP 48:cMxaqGpe3O34C4CLtA6COLtQi2TMZZIJqFbXarLAb:pxPGmst
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14
- Target
  LoaderV4.4/V4.4/040d.ui.strings
- Size 11KB
- SHA256 35601c7fa60df8dd79c1c4433da9babbdeb833f50e7eb18240f88cbbd7027cfc
- MD5 7660d8adec2934ff590edda344a3c5e7
- SHA1 94d611c2fa3d1f5ffa08232dda10f22e317cf4f3
- SHA512 4556bb801643767b4c301dc662d18fe553b95e6a711b2b7bcb295440e9e1282f0f76c9c79f64dd0804acd28251af615fbd9afd90262de26f5434212b9631c95c
- SSDEEP 96:qhXR563YqA0KDRbms3i16DXA2UB5jb511oUWywtiHOCELE2scM5pWOPOD:eh56ytRdojN11dwtiH5EA/cMvWOPOD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  LoaderV4.4/V4.4/040e.ui.forms
- Size 4KB
- SHA256 6f4cee9e3f1674f260f63294ab208731a4b889cb09ac39b1e3e4a59e081a88cb
- MD5 df1bacadadf868d442275f8242b0ec50
- SHA1 84b4a86058b26acb5016f6bf6cebf43c302c3125
- SHA512 6b6262079598366f69e9a798a7daa62e88292532c3e33ec476baaaf64e13fa5193200dc368839701383a68e598cdb59a7bc35f76b1b15dd3e15e2341252df0aa
- SSDEEP 48:csxJDHPG/G4CJCLMAeClLMQi2qMKVzjInIaPL6g:RxJW2Y
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16
- Target
  LoaderV4.4/project.exe
- Size 52.5MB
- SHA256 898e84ed69196f047092951b2b7597dfa082cc598d1e34dc0ac63f1199164042
- MD5 3eb6376c717a6b35a03f3a4e2b6fcd63
- SHA1 a67ea170cadaca17909b5ec073bb67b78021ad93
- SHA512 ffc115a0b247d1b6ca67954fbaef10927b8e061f734ede28559e73e89c4bebafac4bab418c01af0a3d01de7ca0921fc2e810c2481ede181fb5172ca97550b852
- SSDEEP 393216:rD25/dZfUTy8uwiqQEj0+86X9mDwrps7p+5:rD2NdNUu8uaQ6XWg5
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

rhadamanthys discovery evasion execution persistence privilege_escalation stealer trojan
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral17

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks whether UAC is enabled

Maps connected drives based on registry

Checks system information in the registry

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17