General
-
Target
RG_Catalyst.zip
-
Size
105.0MB
-
Sample
240929-ln7cqa1gld
-
MD5
e5f981616d24978f4c2feffa28f19f8f
-
SHA1
82744998c721408e3784c29b569d9c3cd4d2fe17
-
SHA256
ea2bd6c64386d2979f46d49e37b7cbfa9efdef40efeb61709bda7bf9435c3f63
-
SHA512
f137f0b34c3dbb572c30087568e6d5059d855a784693204819655c7b6c1a455e5912130b093f17279824b689d537dc2193e8a3c75c872462cfcdfa2a96734a78
-
SSDEEP
3145728:jmC+XTTsTSi8pZXkVUU1k8q6YSMOavWZB:CX3GsXkVzJ
Malware Config
Targets
-
-
Target
RG_Catalyst.zip
-
Size
105.0MB
-
MD5
e5f981616d24978f4c2feffa28f19f8f
-
SHA1
82744998c721408e3784c29b569d9c3cd4d2fe17
-
SHA256
ea2bd6c64386d2979f46d49e37b7cbfa9efdef40efeb61709bda7bf9435c3f63
-
SHA512
f137f0b34c3dbb572c30087568e6d5059d855a784693204819655c7b6c1a455e5912130b093f17279824b689d537dc2193e8a3c75c872462cfcdfa2a96734a78
-
SSDEEP
3145728:jmC+XTTsTSi8pZXkVUU1k8q6YSMOavWZB:CX3GsXkVzJ
Score10/10-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-