General
- Target rh_0.4.9.exe
- Size 456KB
- Sample240801-tcb2fasenh
- SHA256 f0f70c6ba7dcb338794ee0034250f5f98fc6bddea0922495af863421baf4735f
- MD5 cf4914d021c5a5378428d6f5d3b1c57b
- SHA1 2dc95dc667cf4c49f78b4b8033cec85d889fd069
- SHA512 c07408df7b0bb3f5f57482d9d93b79654e1eb1cb5e938c1e814b25ca6bdf5729c5de85c85b4e91116c38ba875b4611372f6452d1d2ad1e3f2be59b62009fae43
- SSDEEP 6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+n:2uWP/BZUyoLu8Agsmxwrvejkd2
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
rh_0.4.9.exe
Resource
win7-20240729-en
6 signatures
30 seconds
Behavioral task
behavioral2
Sample
rh_0.4.9.exe
Resource
win10v2004-20240730-en
6 signatures
30 seconds
Malware Config
Targets
-
- Target rh_0.4.9.exe
- Size 456KB
- SHA256 f0f70c6ba7dcb338794ee0034250f5f98fc6bddea0922495af863421baf4735f
- MD5 cf4914d021c5a5378428d6f5d3b1c57b
- SHA1 2dc95dc667cf4c49f78b4b8033cec85d889fd069
- SHA512 c07408df7b0bb3f5f57482d9d93b79654e1eb1cb5e938c1e814b25ca6bdf5729c5de85c85b4e91116c38ba875b4611372f6452d1d2ad1e3f2be59b62009fae43
- SSDEEP 6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+n:2uWP/BZUyoLu8Agsmxwrvejkd2
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
Detect rhadamanthys stealer shellcode
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess