Overview

overview

10

Static

static

1

b4346702b4...f2.msi

windows7-x64

10

b4346702b4...f2.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi

  • Size

    23.0MB

  • Sample

    240910-clb95atcra

  • MD5

    4295dda40427af8df6738b3531d63389

  • SHA1

    cb5a45de787c34eda399a3cad64abd3b6133f514

  • SHA256

    b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2

  • SHA512

    31ae6245cc6188e9d8b471c9cb169263fb7189e3d7653266857db01e3b92b1773ddc1971e3468734f48294f48aaf1a1e93b21d3ffc89dc30f6fcf8549c6a24e2

  • SSDEEP

    393216:u66L7jpW/sxwA0Ip5AGgrJmD1Y5D9xAgAmBOn4AZENqMJiaErOQtt4KgTD5v2X:uHWUxOQxZDKNfAuOri9rQtlKy

Score
10/10
rhadamanthysdiscoverypersistenceprivilege_escalationstealer

Malware Config

Targets

    • Target

      b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2.msi

    • Size

      23.0MB

    • MD5

      4295dda40427af8df6738b3531d63389

    • SHA1

      cb5a45de787c34eda399a3cad64abd3b6133f514

    • SHA256

      b4346702b4b5029cbd627b5df724550f8b783ba22876e5070dadc0ed5c214df2

    • SHA512

      31ae6245cc6188e9d8b471c9cb169263fb7189e3d7653266857db01e3b92b1773ddc1971e3468734f48294f48aaf1a1e93b21d3ffc89dc30f6fcf8549c6a24e2

    • SSDEEP

      393216:u66L7jpW/sxwA0Ip5AGgrJmD1Y5D9xAgAmBOn4AZENqMJiaErOQtt4KgTD5v2X:uHWUxOQxZDKNfAuOri9rQtlKy

    Score
    10/10
    rhadamanthysdiscoverypersistenceprivilege_escalationstealer

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks