rhadamanthys

General

Target
InstallerKms.exe
Size 68.0MB
Sample240923-ekdsnswajf
SHA256 9f18caf887db4cccec90f1d018538b77fd5b6e2f7bcaaecbd66fee016f98e10d
MD5 f53efc191a90dd0ba78c961b513efb56
SHA1 0a30f6b17900dd62ba3c76289ae7f427dd8c26cd
SHA512 a4b05a36ce2b58821a14d2f13d176756e0293e777e50e052a52a0543cc2fbee93ae4b0f46af21aa4b5ba86a5414ebc400da60201f25c1da8820620ad408e67a7
SSDEEP 786432:qxGBxG0xG4xGRxGXxGWxGmxGjxGBxG/xG8xGvxGqxGixG:qEBE0E4EREXEWEmEjEBE/E8EvEqEiE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

rhadamanthys

C2

https://185.184.26.10:4928/e4eb12414c95175ccfd/15_SEP

Targets

- Target
  InstallerKms.exe
- Size 68.0MB
- SHA256 9f18caf887db4cccec90f1d018538b77fd5b6e2f7bcaaecbd66fee016f98e10d
- MD5 f53efc191a90dd0ba78c961b513efb56
- SHA1 0a30f6b17900dd62ba3c76289ae7f427dd8c26cd
- SHA512 a4b05a36ce2b58821a14d2f13d176756e0293e777e50e052a52a0543cc2fbee93ae4b0f46af21aa4b5ba86a5414ebc400da60201f25c1da8820620ad408e67a7
- SSDEEP 786432:qxGBxG0xG4xGRxGXxGWxGmxGjxGBxG/xG8xGvxGqxGixG:qEBE0E4EREXEWEmEjEBE/E8EvEqEiE
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

rhadamanthys discovery stealer
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2