Overview

overview

10

Static

static

3

Anubis.exe

windows10-1703-x64

10

Anubis.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    anubisspoofer.rar

  • Size

    2.2MB

  • Sample

    240808-qx3s4stgpm

  • MD5

    6170ea8536ac22e4fe9765d466eb2475

  • SHA1

    75fd34b11bc71181131c0d8bec005d6d9b0c87bc

  • SHA256

    939cdd940184fa0be3ac8de9330d66e144d93396098713278e736e6ab1396f72

  • SHA512

    120b17b2364f579e0e95e7a06358d4f175f5d599c884b7e8de0d384d12e908b80dd5b011d3d7ba643e99d4cc58b7813f71e98a9e95ab8b8f131a391a0253edf0

  • SSDEEP

    49152:NnnY9AataBTX5T8oqMldG7p7DlvSIC2mZac6BYfX9gUmGMP0xBiMh8Y9p:NnnPBTX5T88lE97D62+nPXfnc0riMfD

Score
10/10
rhadamanthysdefense_evasiondiscoverystealer

Malware Config

Targets

    • Target

      Anubis.exe

    • Size

      1.2MB

    • MD5

      c2adb7ff42f1c961035f17bad5bee12d

    • SHA1

      e2ae36539f9ff88e8a89d750e99d15ea6e84f0dc

    • SHA256

      4b350ae0b85aa7f7818e37e3f02397cd3667af8d62eb3132fb3297bd96a0abe2

    • SHA512

      16413f90689cfa3fc509637bea54634ead1bba7f89d621bbc8096279f2413cd3477142a63becfa457e5756583c34049699ab1e960d1133dad2f72e3325ecb348

    • SSDEEP

      24576:uDDgbYd14JwD00GR/L4Sgh5ovGpuIGPBgyjhgQJ8L/inWS:gcbILXoO3p9GP6ydk/inWS

    Score
    10/10
    rhadamanthysdefense_evasiondiscoverystealer

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks