rhadamanthys

General

Target

LoaderV8.zip
Size

15.0MB
Sample

240801-1h1qba1gjd
MD5

b227599e3ee7433b744809b23bbd2970
SHA1

8d63a3389d3c3d8c7e79e54da8c5f9611974b0e7
SHA256

d535b0dffd985929a9e7fc2acc7f420fa8e9c3b9f89e237140898f85c208581e
SHA512

4cf2100571038cbe6fdb56102628dd05d9e14123e7bcd0c6ee1c7c5a35727e0a95e2aa0e6c2f6e476ec770a9b7f89a13da27d01200066d2620be48a6bbcef443
SSDEEP

393216:YlfjdAJ/kHfMO2/w1kBY8l5aFEYF/pAYfxXaI+vQkXLLcDlE610C6:YlfjKsHfMO2/wBFFF/pAYfR0vQk8DlN8

Score

10^/10

Malware Config

Targets

- Target
  
  LoaderV8/SetupV4.4/SetupV4.4.exe
- Size
  
  52.5MB
- MD5
  
  4efe5b34754a7b87e7a2fb46664fb245
- SHA1
  
  7a2ffeac89d92fb0fb987cb6b284133e41a1e666
- SHA256
  
  88f6b132a2f2f4bee053e521ca9a212bca12ed681b223ad615d4263c976e152c
- SHA512
  
  a090deac29ae7aa7baf6411d1eef6121f5fdf09eb3d14f57f2b7e1f1f56859a70d12019234055c74df6e339081529c670bdf035c728244435ea8830b2d6f6b14
- SSDEEP
  
  393216:3T6KLdGUHM9yCKxECB54r6X9eDQrps7p6Y:3T6edGUs9yLEFy+sY
Score

10^/10

rhadamanthys discovery evasion execution persistence privilege_escalation stealer trojan
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Enumerates processes with tasklist
  discovery
- Suspicious use of SetThreadContext
behavioral1