Extracted

• • Target

    699b82c9536a8f8718d686cd4b13027f.exe

  • Size

    13.8MB

  • MD5

    699b82c9536a8f8718d686cd4b13027f

  • SHA1

    cf50c3736cd67282f8142bbb81907363bb446ddd

  • SHA256

    f6289c816a6e59b7eabd07f97a32ac92f98ba35408a1408897c0271570dd16e2

  • SHA512

    b449e23daf94dcbe7a13c65499f225a112228a8c75d4cde38978b143f83e08e775b4839a8d09c37d3a4afadb3a546736665503218d9b22735a8681ec81dd20bc

  • SSDEEP

    393216:sPEvJY6rJIR1stsKIvTme9iWjS5RZyRkxj:s8vJZ+6tsK8RiW8ikxj

  Score

  10^/10

  rhadamanthysdiscoveryevasionexecutionpersistencestealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2

• • Target

    ⌚/sdfgt.exe

  • Size

    423KB

  • MD5

    b8bf5beebfa1cf685e813973902bdf25

  • SHA1

    55ca38cfb317da1926f39fa82ceb6c5b9a43b0b0

  • SHA256

    741b85f17765f4f17c342195642a39a34c8274c01e436b97b4e9294538310fd4

  • SHA512

    bef7e644150163450a8fdb1dce5123bab73942794a6b247c93a09b5e7e30d6f18c35607466ced2a6cb56a66cc5ffa3595e8e77d6e09a22eeb492eddd7729fc6f

  • SSDEEP

    6144:YAYM3ZEWqf/qwPF7LR5W8ZJ74zmRiOFBbMh9q/JSb3ChNeK06iiRzmi0F9:YWBqf/qq3R5W8ZB4zmRzbaasViRUF9

  Score

  1^/10
  behavioral3behavioral4

• • Target

    ⌚/withrobot.exe

  • Size

    14.8MB

  • MD5

    02071fe1b9c8d6ade8dafa0a71600503

  • SHA1

    5b547e72386e43c291bceea5b7d0e8f51469cd3c

  • SHA256

    00c32e90c14f9c866a30256c8499e753397c7385e4a3fbcdc86515b9ee563faf

  • SHA512

    1c4b1c1cb788f08dea954b795d4e0bbd7c028aa5655ce23af805243d06d1c96ef687b0788343182c1d0307e9c76088e4d53e4506e5a4f8d1707001e6549b487a

  • SSDEEP

    393216:9kmzxXRKFz5EKqq7EBCuE/FFicGW8bBekvN:97xXRKFdlP9ijbBvv

  Score

  1^/10
  behavioral5behavioral6