Extracted

• • Target

    GoogleAuthenticator_em_IxMqegG7_installer_Win7-Win11_x86_x64.MSI.msi

  • Size

    94.2MB

  • MD5

    f740670bd608f6a564366606e0bba8da

  • SHA1

    c635e8453bf0f06c34d41d3319670e5dc966a5f4

  • SHA256

    ba3cdc5190b44da96e5ecb5f39e2cbe3713984dc8062cdab679c759de51500b1

  • SHA512

    88f1e800265e4e72f914e50240a6a7cca630ea4bcd6981be13237cc6f42b182741542b907737490a367453c179ace55fb64c3e0fb2cb6ecf1bace7a442458e0e

  • SSDEEP

    1572864:SX+lBWb7cVOxi2CDRq/SUx6EIL2CjmFkm+pF7Vxo81MOL9vh12epl37cTLiAhRLh:nLYxsRq/76L2CjmCZpRXouxvD6LbhRHJ

  Score

  10^/10

  rhadamanthyssectopratdiscoveryexecutionpersistenceprivilege_escalationratstealertrojan

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Checks for any installed AV software in registry

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Command and Scripting Interpreter: AutoIT

    Using AutoIT for possible automate script.

    execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2