rhadamanthys

General

Target

setup.zip
Size

15.6MB
Sample

240730-b8zhha1hpp
MD5

6f275e8dedde7f0d475c454df6da9db3
SHA1

8ef7b71463322c4f109a6e21b7123718c2dae598
SHA256

f90867879e21c9d25daa3e434a25cd0288048a154896f58ec3ce28d3870b9653
SHA512

965ba8465c455cf3d85d24cbb927dd1dc9a273be4bae9941193f88e595fcc08d8f09840eb685d0d027691fe9ee8e16454bb275f26a99c16778f3f93113bcd2c5
SSDEEP

393216:e/4FV0uFyRuQ5FdsWyTRncFjDKhT8ejXaI+zmFevf9cqDdemY:e/4FRyRuQ5FdNASKhT8S0yFK9bxex

Score

10^/10

Malware Config

Targets

- Target
  
  setup/setup.exe
- Size
  
  52.5MB
- MD5
  
  fb924a28fbc84203e357faa853965195
- SHA1
  
  41815d7b8ffe39e8e31784d6709e551b0efc2dd9
- SHA256
  
  d81fb7571192a384e38cfa45b637118cab1e4f5623a2e2728afcebe85230e39e
- SHA512
  
  9914e41fa060c122f34ac6ae2726c7358ded52fe8d483acfcbf893814c1f10ebe6624442afa0692b41e18b316d1404e12e809acc6b32880a6c856bbe6aa35837
- SSDEEP
  
  393216:ubalLdWhqUsBeI2e/su0p4d6X9RDQrps7p91:ubaFd+qU0eIhso0NX1
Score

10^/10

rhadamanthys discovery evasion execution persistence privilege_escalation stealer trojan
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1