rhadamanthys

General

Target

.
Size

367B
Sample

240803-hk47eawclq
MD5

3b8307ef19d66fd00abf5228ffa0a0d2
SHA1

4f1f15dba825d0f9319ea0da6c3b0e9abe5a2515
SHA256

3802dd9ae43b910b50d7c718b14b7d6765b1e2b22cc5dc70c34ef381843173e5
SHA512

acf0da0fe726c5fd0df3dbd2e4f97b7349077311ef95c29cd78772ab69d261df701c29ffcf40a682147e1125efe816e8c775164662f382c5a42b4c794d95ebee

Score

10^/10

Malware Config

Targets

- Target
  
  .
- Size
  
  367B
- MD5
  
  3b8307ef19d66fd00abf5228ffa0a0d2
- SHA1
  
  4f1f15dba825d0f9319ea0da6c3b0e9abe5a2515
- SHA256
  
  3802dd9ae43b910b50d7c718b14b7d6765b1e2b22cc5dc70c34ef381843173e5
- SHA512
  
  acf0da0fe726c5fd0df3dbd2e4f97b7349077311ef95c29cd78772ab69d261df701c29ffcf40a682147e1125efe816e8c775164662f382c5a42b4c794d95ebee
Score

10^/10

rhadamanthys credential_access discovery execution spyware stealer
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1