Extracted

• • Target

    mmpack/mmpack.exe

  • Size

    785.9MB

  • MD5

    17fa54200d0a4a000d5efbf602b8a0e6

  • SHA1

    b843e32e8116bf481a25c2849cc14e9df89e902d

  • SHA256

    d3fa6f22e10ed36f833ce25a16f7bf93eaf0c5e9b5e3ddd5203c73c11a98e71b

  • SHA512

    b25e8ec4d0e0b28aa51c15fc6394b807faba9b2004921e0186f380a72249a24cbb129d2c71a5a6dcd67485c7954524729151b360161b34602b6bc9fb90c7ca1b

  • SSDEEP

    49152:bvvAQlU+7RzxP5z5ASE3MkiGgFDXtuCsVsvcrb6FMbSuvUkt77:s6RzxP5z5A93MkiGgFLtuCtvcrbXUo77

  Score

  10^/10

  rhadamanthysxmrigdiscoveryevasionexecutionminerpersistencestealerupx

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1