rhadamanthys | 53effbe0b363e1161baa3f6515013f6bbe585213d5293ca065dad9dc952db37d | Triage

Submit
Reports

Overview

overview

Static

static

3

LisectAVT_...09.exe

windows7-x64

LisectAVT_...09.exe

windows10-2004-x64

Sharing

General

Target

LisectAVT_2403002B_209.exe
Size

565KB
Sample

240725-bf5ttayclq
MD5

91e5ea8115f0100e118a79d824ae7bcb
SHA1

f021ccb22e53bcad377ed4cbebee7082ad9b2b14
SHA256

53effbe0b363e1161baa3f6515013f6bbe585213d5293ca065dad9dc952db37d
SHA512

02993625ccaa8716050406b2b551c7149f38d792855e282251e3901f14d1d0a608329aa0f4aeb51b7a86baf334867c40565d66d2df161b08540d899203ca2822
SSDEEP

12288:tRRWUBcOjgPPH2yWRxwLQ+Pns8Nn1UKk0U:tWWcOKObRxwLQMswn1UKk0U

Score

10^/10

rhadamanthys aspackv2 discovery stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

LisectAVT_2403002B_209.exe

Resource

win7-20240704-en

rhadamanthys aspackv2 discovery stealer

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

LisectAVT_2403002B_209.exe

Resource

win10v2004-20240709-en

rhadamanthys aspackv2 discovery stealer

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  LisectAVT_2403002B_209.exe
- Size
  
  565KB
- MD5
  
  91e5ea8115f0100e118a79d824ae7bcb
- SHA1
  
  f021ccb22e53bcad377ed4cbebee7082ad9b2b14
- SHA256
  
  53effbe0b363e1161baa3f6515013f6bbe585213d5293ca065dad9dc952db37d
- SHA512
  
  02993625ccaa8716050406b2b551c7149f38d792855e282251e3901f14d1d0a608329aa0f4aeb51b7a86baf334867c40565d66d2df161b08540d899203ca2822
- SSDEEP
  
  12288:tRRWUBcOjgPPH2yWRxwLQ+Pns8Nn1UKk0U:tWWcOKObRxwLQMswn1UKk0U
Score

10^/10

rhadamanthys aspackv2 discovery stealer
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

rhadamanthysaspackv2discoverystealer

behavioral2

rhadamanthysaspackv2discoverystealer

© 2018-2025

Terms | Privacy