rhadamanthys | 2d5d858b43fe97c55ffa2c8fd2066b3b034107a487b36d356ffb22b719d50c2d | Triage

Sharing

General

Target

2d5d858b43fe97c55ffa2c8fd2066b3b034107a487b36d356ffb22b719d50c2d
Size

3.7MB
Sample

240806-zz9h4sthra
MD5

5622d3d7a3d5d267bbe14515f4e3d78b
SHA1

63778bd218177ab48f80105fc67bed6dd0d7ea13
SHA256

2d5d858b43fe97c55ffa2c8fd2066b3b034107a487b36d356ffb22b719d50c2d
SHA512

dc1bfbd0cb1b3b24612664f6fae9384e394c37c5bc42bef2334e4c4fe5e51359da3a563c7eeab15b7af6e9c3773fa78efa5b944049ff02552364223b2e96be8b
SSDEEP

98304:LsauS6GjgH9VuQs7DbiZXS0ix+6k9BqtPvN5bf/mf6OmpzgkfKbuQ:WqjIa7iZXSw6qBGvnmyDKbuQ

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Targets

- Target
  
  95e31ee2a74f11c0705e9eec34cd2707986f5c962eb751cfd3abdcb6b98cf19d.exe
- Size
  
  13.5MB
- MD5
  
  2d49f4f1c9964d0f735c46fc0750561e
- SHA1
  
  69fbd91314fb0543b627df7a3688fcf067111846
- SHA256
  
  95e31ee2a74f11c0705e9eec34cd2707986f5c962eb751cfd3abdcb6b98cf19d
- SHA512
  
  f4230ac53e6a23a330ab2cb2189504c50f10597c50fead263d6d48eb2c671ea2d5c18b19c0dca99f39e9915258da3f4ac174a6a739f8f16eac786c4480494327
- SSDEEP
  
  98304:FIblLdzWste0R8lsJdf0EMVTZvWYOht+GZQ1Iod5f:4LtWstKlsJdfNhtHZQL5f
Score

10^/10

rhadamanthys discovery stealer
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

rhadamanthysdiscoverystealer