General

  • Target

    9096c9ab92e7832fcc34c80a121661c750af0c72b153a90a54e32452b78d73d0

  • Size

    1.1MB

  • Sample

    240920-c52zwsvaqa

  • MD5

    183d3258056265d85665725d1d995126

  • SHA1

    606765ff639a2699f0e9df650ceb91b658a5521d

  • SHA256

    9096c9ab92e7832fcc34c80a121661c750af0c72b153a90a54e32452b78d73d0

  • SHA512

    8a57e8ba15f59ae1f971888b3492a04a1faf5db104743998f3ea5c41477fb36c7572547c93302e343f3aa86b6a29a615a51b904d406c11694d10915bfe0ae925

  • SSDEEP

    24576:OoU4GxhwybZN2yb0ykH3t0P/Z63iY4Er6ySE4ppEakzEqEK/oi:OyWr2ybhkdLmPhAakzsqf

Malware Config

Extracted

Family

rhadamanthys

C2

https://217.197.107.204:443/e0bd9c1f4515facb49/gj28n35o.2n73x

Targets

    • Target

      9096c9ab92e7832fcc34c80a121661c750af0c72b153a90a54e32452b78d73d0

    • Size

      1.1MB

    • MD5

      183d3258056265d85665725d1d995126

    • SHA1

      606765ff639a2699f0e9df650ceb91b658a5521d

    • SHA256

      9096c9ab92e7832fcc34c80a121661c750af0c72b153a90a54e32452b78d73d0

    • SHA512

      8a57e8ba15f59ae1f971888b3492a04a1faf5db104743998f3ea5c41477fb36c7572547c93302e343f3aa86b6a29a615a51b904d406c11694d10915bfe0ae925

    • SSDEEP

      24576:OoU4GxhwybZN2yb0ykH3t0P/Z63iY4Er6ySE4ppEakzEqEK/oi:OyWr2ybhkdLmPhAakzsqf

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

MITRE ATT&CK Enterprise v15

Tasks