General

  • Target

    Setup_Installer_x32_x64.exe

  • Size

    65.2MB

  • Sample

    240821-sx9yjawerd

  • MD5

    5a9fbc711d0d48ff0a3bcd88c85ca190

  • SHA1

    dfdc8f4accf88a7962303c96d6db883a5b4a7df4

  • SHA256

    cffc1aa878acf0050880a3e71017e09e557fe8785ad57a9aab8fb2d9846f426c

  • SHA512

    ac52cf6281d954315af4170a46c62d01f3ec2996a57f1fac0c30f79fe5abce91f7ad0ef402f9284277ba5bee23110cdb97553665e265ab2020b11af0bcacc2d8

  • SSDEEP

    24576:b8IaZblcaDxTdPGSrVSLg4p1R7i+S7vCYh:bfSbzDDgpj7iX

Malware Config

Extracted

Family

rhadamanthys

C2

https://172.236.107.96/5502b8a765a7d7349/jhwj0w4u.rjdbs

Targets

    • Target

      Setup_Installer_x32_x64.exe

    • Size

      65.2MB

    • MD5

      5a9fbc711d0d48ff0a3bcd88c85ca190

    • SHA1

      dfdc8f4accf88a7962303c96d6db883a5b4a7df4

    • SHA256

      cffc1aa878acf0050880a3e71017e09e557fe8785ad57a9aab8fb2d9846f426c

    • SHA512

      ac52cf6281d954315af4170a46c62d01f3ec2996a57f1fac0c30f79fe5abce91f7ad0ef402f9284277ba5bee23110cdb97553665e265ab2020b11af0bcacc2d8

    • SSDEEP

      24576:b8IaZblcaDxTdPGSrVSLg4p1R7i+S7vCYh:bfSbzDDgpj7iX

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks