General
-
Target
msvcp110.dll
-
Size
652KB
-
Sample
241003-rx9r4atejc
-
MD5
536bc1eadab8af8f052544cfcd5150ec
-
SHA1
ff3c9ee18e0e6f3f3a7b04e6c4c210d0adf29232
-
SHA256
876feac850e9030e3aff1b7bd69f85a613d21661e9350b7fa10dd263a61724fe
-
SHA512
33eae31cee1dd47e490111c7cd2fc0871e69b5a42fb24d807aa52b65ca9a6e457028ff8bea1ca2115a05f4ff99dd2c6c8075e3267d19b62b15087b437ca09d6c
-
SSDEEP
12288:vgQY+jL8MsthpNREymEG26+hbE64VJuzl8vr4JHdi7:vy5thpNRFxXblE67mX7
Static task
static1
Behavioral task
behavioral1
Sample
msvcp110.dll
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
msvcp110.dll
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
msvcp110.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
msvcp110.dll
Resource
win11-20240802-en
Malware Config
Extracted
rhadamanthys
https://135.181.4.162:2423/97e9fc994198e76/9dq0b1sl.pbl6a
Targets
-
-
Target
msvcp110.dll
-
Size
652KB
-
MD5
536bc1eadab8af8f052544cfcd5150ec
-
SHA1
ff3c9ee18e0e6f3f3a7b04e6c4c210d0adf29232
-
SHA256
876feac850e9030e3aff1b7bd69f85a613d21661e9350b7fa10dd263a61724fe
-
SHA512
33eae31cee1dd47e490111c7cd2fc0871e69b5a42fb24d807aa52b65ca9a6e457028ff8bea1ca2115a05f4ff99dd2c6c8075e3267d19b62b15087b437ca09d6c
-
SSDEEP
12288:vgQY+jL8MsthpNREymEG26+hbE64VJuzl8vr4JHdi7:vy5thpNRFxXblE67mX7
Score10/10-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Suspicious use of SetThreadContext
-