rhadamanthys

General

Target

f4b1f75feb5864acae90b00168dda506c169334a98bb7a147e33e18725a660a4.msi
Size

32.8MB
Sample

240823-ddgqbatgmn
MD5

86a6e8316dda14183644539895fbe10d
SHA1

061e8bb0bf7b9a6b3efc919d48187cbf6e6d39ed
SHA256

f4b1f75feb5864acae90b00168dda506c169334a98bb7a147e33e18725a660a4
SHA512

74fe5fa99cd652ca75b7afc077a54216df7b594d3c3e20e323b76cc7d361df121af2f69915cf680e1e19c117545bf038d6a7855961574707fbf30395a066bb8c
SSDEEP

786432:inLwZc62Yf1cfloFG/AavUcpjuwi0biBG:iLwaroFWAavUcRN

Score

10^/10

Malware Config

Targets

- Target
  
  f4b1f75feb5864acae90b00168dda506c169334a98bb7a147e33e18725a660a4.msi
- Size
  
  32.8MB
- MD5
  
  86a6e8316dda14183644539895fbe10d
- SHA1
  
  061e8bb0bf7b9a6b3efc919d48187cbf6e6d39ed
- SHA256
  
  f4b1f75feb5864acae90b00168dda506c169334a98bb7a147e33e18725a660a4
- SHA512
  
  74fe5fa99cd652ca75b7afc077a54216df7b594d3c3e20e323b76cc7d361df121af2f69915cf680e1e19c117545bf038d6a7855961574707fbf30395a066bb8c
- SSDEEP
  
  786432:inLwZc62Yf1cfloFG/AavUcpjuwi0biBG:iLwaroFWAavUcRN
Score

10^/10

discovery persistence privilege_escalation rhadamanthys collection credential_access execution spyware stealer
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2