rhadamanthys

General

Target

Gatherum.exe
Size

47.3MB
Sample

240729-de79natflc
MD5

3730b778d99878116f6b88afcbeef23f
SHA1

8d9b2ad3f9ac19987e036bec2dfa672e3815b66b
SHA256

d603137c0fa78fad4cf0f80498fddb7eb0e8f115a9d360e9ec88d21cbbeb6944
SHA512

275d39e2e531b22cac4f68d5ae5e38e99d6263dc610de16987aa847e3a06b7c652e89b581a7815be935efd730a9255e3002a84226df4272ed3a4129f57c9d398
SSDEEP

786432:4FfLgppR8t2argpex0I5z34qNBvf36IiQNIt7dOZ6xKpu3lbBVBZ1fNJ1zL7rDjh:4FfLgppR8t2KsefBIqNBvP6I2MQApu3b

Score

10^/10

Malware Config

Targets

- Target
  
  Gatherum.exe
- Size
  
  47.3MB
- MD5
  
  3730b778d99878116f6b88afcbeef23f
- SHA1
  
  8d9b2ad3f9ac19987e036bec2dfa672e3815b66b
- SHA256
  
  d603137c0fa78fad4cf0f80498fddb7eb0e8f115a9d360e9ec88d21cbbeb6944
- SHA512
  
  275d39e2e531b22cac4f68d5ae5e38e99d6263dc610de16987aa847e3a06b7c652e89b581a7815be935efd730a9255e3002a84226df4272ed3a4129f57c9d398
- SSDEEP
  
  786432:4FfLgppR8t2argpex0I5z34qNBvf36IiQNIt7dOZ6xKpu3lbBVBZ1fNJ1zL7rDjh:4FfLgppR8t2KsefBIqNBvP6I2MQApu3b
Score

10^/10

discovery rhadamanthys credential_access execution spyware stealer
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2