rhadamanthys

General

Target

Solara_roblox.zip
Size

15.2MB
Sample

240723-sxc9kaxbnj
MD5

325eaa719d119aa8a559410b7af339fd
SHA1

3fcad09ac80ab0e9c056eab70b55887ea4245df3
SHA256

3f767ffe96383bc3850ccecde867a3d4395b647947c9a3f004fbbc4894302136
SHA512

d76e0fd995621f9267aa5dd25e23bdcd2247fd3732f268f8afc2e382f703e009e97fbfa1022f3d69aa851a1e261267614d923ae2a311fe1177ea3b4036f77e35
SSDEEP

393216:C2qI4zgeCPIFiglX8Cw0777rnkmHueNS6gEPX+0ZrSZ+Y7:CXI3Iwg/f7kmDN9POoA

Score

10^/10

Malware Config

Targets

- Target
  
  api-ms-win-core-console-l1-1-0.dll
- Size
  
  18KB
- MD5
  
  cde2424d99db56dd0d1eaf34811738c1
- SHA1
  
  cc7889c43729b93a4e193b2fd6ae5f22b6ad6b8f
- SHA256
  
  4ceaf28cadfd0929b44e9c686b93432a7151504c8ffe2a6afe516f9b16538131
- SHA512
  
  d5b8ef2de3fefde29b2c9cccb330c3076ba71d6ae29e1b34617057d8a832d37eae8e2f238e2abb6eb226453c00a835c669a7c03a00cd1698d02272d8eb6998e2
- SSDEEP
  
  192:MgWuufhW3a4V10b8uDBks/nGfe4pBjS7EQ8WebtuVaVWQ4eWbKqnajy3Snk0lpn:1W5hWq+10vq0GftpBj5fZblGinjXn
Score

1^/10
behavioral1
- Target
  
  api-ms-win-core-datetime-l1-1-0.dll
- Size
  
  17KB
- MD5
  
  acf4321ac8c8ff4d0442c799d621f8d9
- SHA1
  
  b12f87e6afc48697f1ce8b587715361e89b79cae
- SHA256
  
  69b84f7318798a91143e3d273ae9c0bedaabba930e3702447d493e2b8dd70725
- SHA512
  
  7878a7cd62f9d259a6bab05e13e9ac5b16437c0d8bda46e864f205465ae19531e5655d7547ae1594a53a05ddeb8b0c6058a73caeb21cd7c81fe5a424303d3bde
- SSDEEP
  
  192:hEWuufhWr2ivT16uDBks/nGfe4pBjSbGPKA8WebtuVaVWQ4mWOC9qnajjpxf9c98:aW5hWPvT1Nq0GftpBjjeZRC9lBLcT+
Score

1^/10
behavioral2
- Target
  
  api-ms-win-core-debug-l1-1-0.dll
- Size
  
  17KB
- MD5
  
  3c47c25b8141d20b2b4d576000000a61
- SHA1
  
  04543f9cdd847ff66389c9fd1e12b444dae6383a
- SHA256
  
  290030199e8b47d6bcf466f9fc81fee7e6aebc2c16a3f26dd77019f795658956
- SHA512
  
  c599ef06045583b28faac051909c28f5f2fa56c34d47f3bd49efc101a1cdcb571a298eb100d0b381e3ebb1ba19b2fb4dd5127f259eb8ab183753722ecbe0f10a
- SSDEEP
  
  384:M7eW5hWlo+10vq0GftpBj2uZwDkIldBQ7QMI:YkeinqDFQnI
Score

1^/10
behavioral3
- Target
  
  setup.exe
- Size
  
  52.5MB
- MD5
  
  4efe5b34754a7b87e7a2fb46664fb245
- SHA1
  
  7a2ffeac89d92fb0fb987cb6b284133e41a1e666
- SHA256
  
  88f6b132a2f2f4bee053e521ca9a212bca12ed681b223ad615d4263c976e152c
- SHA512
  
  a090deac29ae7aa7baf6411d1eef6121f5fdf09eb3d14f57f2b7e1f1f56859a70d12019234055c74df6e339081529c670bdf035c728244435ea8830b2d6f6b14
- SSDEEP
  
  393216:3T6KLdGUHM9yCKxECB54r6X9eDQrps7p6Y:3T6edGUs9yLEFy+sY
Score

10^/10

rhadamanthys discovery evasion execution persistence privilege_escalation stealer trojan
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Enumerates processes with tasklist
  discovery
- Suspicious use of SetThreadContext
behavioral4