Overview

overview

10

Static

static

1

URLScan

urlscan

https://www.youtube....

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqa3BOVGF5SEhBOFU2TV9GRHVCSTh6WXVHOWdpUXxBQ3Jtc0ttYWdHT09SMHZ2emk5d1k1RHR6WGRYYnQ3cW5GSUxxMWY2M3VRd19maHQ4OC1zR1dsNU1sVk1jUnRxVlJzU1B6WDh0VDV4eHA3OUsxTHNsQzJUSUttQUtUVlRUd2JOS1FYSzU5S0Q2dnBydWdYNHlPWQ&q=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffi%2Fpmmgc1dy3ngb8z25lozsw%2Flauncher.zip%3Frlkey%3Dgqrmv1tmjof7lx8j96d7wv54k%26st%3D0xwbyajb%26dl%3D1

  • Sample

    241011-qffx1syfqj

Score
10/10
rhadamanthysdiscoveryexecutionstealer

Malware Config

Targets

    • Target

      https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqa3BOVGF5SEhBOFU2TV9GRHVCSTh6WXVHOWdpUXxBQ3Jtc0ttYWdHT09SMHZ2emk5d1k1RHR6WGRYYnQ3cW5GSUxxMWY2M3VRd19maHQ4OC1zR1dsNU1sVk1jUnRxVlJzU1B6WDh0VDV4eHA3OUsxTHNsQzJUSUttQUtUVlRUd2JOS1FYSzU5S0Q2dnBydWdYNHlPWQ&q=https%3A%2F%2Fwww.dropbox.com%2Fscl%2Ffi%2Fpmmgc1dy3ngb8z25lozsw%2Flauncher.zip%3Frlkey%3Dgqrmv1tmjof7lx8j96d7wv54k%26st%3D0xwbyajb%26dl%3D1

    Score
    10/10
    rhadamanthysdiscoveryexecutionstealer

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks