Overview

overview

10

Static

static

7

2e14444994...d8.exe

windows7-x64

10

2e14444994...d8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8

  • Size

    360KB

  • Sample

    240807-xk64bswanf

  • MD5

    b87affd72eb26d3466795d92485cf59f

  • SHA1

    b8a17fda447f29f20c95a86f6a856b0e95d24d8f

  • SHA256

    2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8

  • SHA512

    b47407e588100fb6ffedff129c7d49f1c0297ae4b6d91375f33896fda336e0abbeef2c8bc9fbdb4b5bd5d4f296a0478e9bb84f6bc05e691c2695cfd246bae35a

  • SSDEEP

    6144:9l4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ixP:f1t/6+6pWG8aRna9RYSQTXtV8s98E

Score
10/10
rhadamanthysagilenetstealer

Malware Config

Targets

    • Target

      2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8

    • Size

      360KB

    • MD5

      b87affd72eb26d3466795d92485cf59f

    • SHA1

      b8a17fda447f29f20c95a86f6a856b0e95d24d8f

    • SHA256

      2e1444499438a47d083214d2b9f3e0af3b5bb164219bee59f0b584fe2df18ed8

    • SHA512

      b47407e588100fb6ffedff129c7d49f1c0297ae4b6d91375f33896fda336e0abbeef2c8bc9fbdb4b5bd5d4f296a0478e9bb84f6bc05e691c2695cfd246bae35a

    • SSDEEP

      6144:9l4ypBt/6bC6p/8jJkJaVnQUKRnazBrRYJs3mb2stMK39V8s98ixP:f1t/6+6pWG8aRna9RYSQTXtV8s98E

    Score
    10/10
    rhadamanthysagilenetstealer

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks