Overview

overview

10

Static

static

3

rhad_0_4_9...5f.exe

windows7-x64

10

rhad_0_4_9...5f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    240724-12w68sj362_pw_infected.zip

  • Size

    232KB

  • Sample

    240731-1gsnbavbmk

  • MD5

    385a99fbd3a3b63bd708cac327b7a21d

  • SHA1

    fea647ee65344b2b21daa9c37e7d6b70f2671fd6

  • SHA256

    6229f2951cbf50a76e621a3be6fa543e86538c9da67f47ab539ff52b91e5eaf6

  • SHA512

    071f82133f47b372b5a86738a4e37428cee540e227686e321152a94ee288386e0d34924f1d8d5c0e9fc9607536104d77a065fae897973125e21da748a833d931

  • SSDEEP

    6144:0JKPKXeXGZQ9iGtbvCAHJ1gg8EKZGqURMaJvoeZLYduBOa3:UKPKXeXGK9iGlCAgg8LZGjRMgvoeZLYC

Score
10/10
rhadamanthysdiscoverystealer

Malware Config

Targets

    • Target

      rhad_0_4_9_f0f70c6ba7dcb338794ee0034250f5f98fc6bddea0922495af863421baf4735f

    • Size

      456KB

    • MD5

      cf4914d021c5a5378428d6f5d3b1c57b

    • SHA1

      2dc95dc667cf4c49f78b4b8033cec85d889fd069

    • SHA256

      f0f70c6ba7dcb338794ee0034250f5f98fc6bddea0922495af863421baf4735f

    • SHA512

      c07408df7b0bb3f5f57482d9d93b79654e1eb1cb5e938c1e814b25ca6bdf5729c5de85c85b4e91116c38ba875b4611372f6452d1d2ad1e3f2be59b62009fae43

    • SSDEEP

      6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+n:2uWP/BZUyoLu8Agsmxwrvejkd2

    Score
    10/10
    rhadamanthysdiscoverystealer

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks