Main
Overview
overview
10Static
static
10Rhadamanth...anthys
ubuntu-24.04-amd64
3index.html
windows7-x64
3index.html
windows10-2004-x64
3js/app.33c5ca84.js
windows7-x64
3js/app.33c5ca84.js
windows10-2004-x64
3js/chunk-1...9eb.js
windows7-x64
3js/chunk-1...9eb.js
windows10-2004-x64
3js/chunk-2...a5b.js
windows7-x64
3js/chunk-2...a5b.js
windows10-2004-x64
3js/chunk-2...142.js
windows7-x64
3js/chunk-2...142.js
windows10-2004-x64
3js/chunk-2...bac.js
windows7-x64
3js/chunk-2...bac.js
windows10-2004-x64
3js/chunk-2...804.js
windows7-x64
3js/chunk-2...804.js
windows10-2004-x64
3js/chunk-2...c79.js
windows7-x64
3js/chunk-2...c79.js
windows10-2004-x64
3js/chunk-3...83f.js
windows7-x64
3js/chunk-3...83f.js
windows10-2004-x64
3js/chunk-4...371.js
windows7-x64
3js/chunk-4...371.js
windows10-2004-x64
3js/chunk-4...c9f.js
windows7-x64
3js/chunk-4...c9f.js
windows10-2004-x64
3js/chunk-5...746.js
windows7-x64
3js/chunk-5...746.js
windows10-2004-x64
3js/chunk-6...912.js
windows7-x64
3js/chunk-6...912.js
windows10-2004-x64
3js/chunk-6...f72.js
windows7-x64
3js/chunk-6...f72.js
windows10-2004-x64
3js/chunk-7...ee6.js
windows7-x64
3js/chunk-7...ee6.js
windows10-2004-x64
3js/chunk-7...35c.js
windows7-x64
3Behavioral task
behavioral1
Sample
Rhadamanthys-Stealer-main/usr/local/rhadamanthys/bin/rhadamanthys
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral2
Sample
index.html
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
index.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
js/app.33c5ca84.js
Resource
win7-20240729-en
Behavioral task
behavioral5
Sample
js/app.33c5ca84.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
js/chunk-1684fe62.6be499eb.js
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
js/chunk-1684fe62.6be499eb.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
js/chunk-27619195.89031a5b.js
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
js/chunk-27619195.89031a5b.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
js/chunk-2ba3522d.0b719142.js
Resource
win7-20240729-en
Behavioral task
behavioral11
Sample
js/chunk-2ba3522d.0b719142.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
js/chunk-2d0f0c1c.f42f3bac.js
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
js/chunk-2d0f0c1c.f42f3bac.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
js/chunk-2d208126.71806804.js
Resource
win7-20240708-en
Behavioral task
behavioral15
Sample
js/chunk-2d208126.71806804.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
js/chunk-2d213927.801a7c79.js
Resource
win7-20240708-en
Behavioral task
behavioral17
Sample
js/chunk-2d213927.801a7c79.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
js/chunk-383adc72.e20b983f.js
Resource
win7-20241010-en
Behavioral task
behavioral19
Sample
js/chunk-383adc72.e20b983f.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
js/chunk-40c6d242.c0252371.js
Resource
win7-20241010-en
Behavioral task
behavioral21
Sample
js/chunk-40c6d242.c0252371.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
js/chunk-4c19539f.11bf8c9f.js
Resource
win7-20240729-en
Behavioral task
behavioral23
Sample
js/chunk-4c19539f.11bf8c9f.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
js/chunk-510960b8.b0886746.js
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
js/chunk-510960b8.b0886746.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
js/chunk-6534c7f9.c14bd912.js
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
js/chunk-6534c7f9.c14bd912.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
js/chunk-675011d0.32369f72.js
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
js/chunk-675011d0.32369f72.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
js/chunk-746e6094.65f77ee6.js
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
js/chunk-746e6094.65f77ee6.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
js/chunk-7cb61fec.6f5b735c.js
Resource
win7-20240708-en
General
-
Target
Rhadamanthys-Stealer-main.zip
-
Size
9.3MB
-
MD5
9730865350884e579559e2c777cd1b1f
-
SHA1
252d2be830095e8e7d0e9871762a125d63fe58ab
-
SHA256
5219f7c44533b422bb083855401a3beb2b55e29b03cc739f18540bdcf361f31d
-
SHA512
1d84471a619786bfffc2fece18e7a9f1b5140ff35cac9ddf618212bc78b58ba0d4334250c061c60e0eb0c5b2d105c856e3297db4e9f418f39a4a4b59afe23685
-
SSDEEP
196608:8A0e32K2j3i+oaNOVEzcrzejVQ53ChT8GCRr5+LATOzd3Sh:8raV2KaIV6cXyVQ5yhT8GCRSSOzsh
Malware Config
Signatures
-
Rhadamanthys family
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack003/dist.exe unpack004/dist.dll
Files
-
Rhadamanthys-Stealer-main.zip.zip
-
Rhadamanthys-Stealer-main/README.md
-
Rhadamanthys-Stealer-main/lib/systemd/system/rhadamanthys.service
-
Rhadamanthys-Stealer-main/usr/local/rhadamanthys/bin/rhadamanthys.elf linux x64
-
Rhadamanthys-Stealer-main/usr/local/rhadamanthys/data/framework/admin.zip.zip
-
assets/background.5825f033.svg.xml
-
assets/logo.faa4fd30.svg.xml
-
css/app.a2eefdbf.css
-
css/chunk-2ba3522d.cd774f60.css
-
css/chunk-383adc72.a288569d.css
-
css/chunk-40c6d242.b9dfda46.css
-
css/chunk-675011d0.c555af39.css
-
css/chunk-7cb61fec.0c8f532d.css
-
css/chunk-c9243436.763c74f4.css
-
css/chunk-vendors.85113dec.css
-
css/user.188047a9.css
-
flags/ad.svg.xml
-
flags/ae.svg.xml
-
flags/af.svg.xml
-
flags/ag.svg.xml
-
flags/ai.svg.xml
-
flags/al.svg.xml
-
flags/am.svg.xml
-
flags/ao.svg.xml
-
flags/aq.svg
-
flags/ar.svg.xml
-
flags/as.svg.xml
-
flags/at.svg.xml
-
flags/au.svg.xml
-
flags/aw.svg.xml
-
flags/ax.svg.xml
-
flags/az.svg.xml
-
flags/ba.svg.xml
-
flags/bb.svg.xml
-
flags/bd.svg.xml
-
flags/be.svg.xml
-
flags/bf.svg.xml
-
flags/bg.svg.xml
-
flags/bh.svg.xml
-
flags/bi.svg.xml
-
flags/bj.svg.xml
-
flags/bl.svg.xml
-
flags/bm.svg.xml
-
flags/bn.svg.xml
-
flags/bo.svg.xml
-
flags/bq.svg.xml
-
flags/br.svg.xml
-
flags/bs.svg.xml
-
flags/bt.svg.xml
-
flags/bv.svg.xml
-
flags/bw.svg.xml
-
flags/by.svg.xml
-
flags/bz.svg.xml
-
flags/ca.svg.xml
-
flags/cc.svg.xml
-
flags/cd.svg.xml
-
flags/cf.svg.xml
-
flags/cg.svg.xml
-
flags/ch.svg.xml
-
flags/ci.svg.xml
-
flags/ck.svg.xml
-
flags/cl.svg.xml
-
flags/cm.svg.xml
-
flags/cn.svg.xml
-
flags/co.svg.xml
-
flags/cr.svg.xml
-
flags/cu.svg.xml
-
flags/cv.svg.xml
-
flags/cw.svg.xml
-
flags/cx.svg.xml
-
flags/cy.svg.xml
-
flags/cz.svg.xml
-
flags/de.svg.xml
-
flags/dj.svg.xml
-
flags/dk.svg.xml
-
flags/dm.svg.xml
-
flags/do.svg.xml
-
flags/dz.svg.xml
-
flags/ec.svg.xml
-
flags/ee.svg.xml
-
flags/eg.svg.xml
-
flags/eh.svg.xml
-
flags/er.svg.xml
-
flags/es.svg.xml
-
flags/et.svg.xml
-
flags/fi.svg.xml
-
flags/fj.svg.xml
-
flags/fk.svg.xml
-
flags/fm.svg.xml
-
flags/fo.svg.xml
-
flags/fr.svg.xml
-
flags/ga.svg.xml
-
flags/gb.svg.xml
-
flags/gd.svg.xml
-
flags/ge.svg.xml
-
flags/gf.svg.xml
-
flags/gg.svg.xml
-
flags/gh.svg.xml
-
flags/gi.svg.xml
-
flags/gl.svg.xml
-
flags/gm.svg.xml
-
flags/gn.svg.xml
-
flags/gp.svg.xml
-
flags/gq.svg.xml
-
flags/gr.svg.xml
-
flags/gs.svg
-
flags/gt.svg.xml
-
flags/gu.svg.xml
-
flags/gw.svg.xml
-
flags/gy.svg
-
flags/hk.svg.xml
-
flags/hm.svg.xml
-
flags/hn.svg.xml
-
flags/hr.svg.xml
-
flags/ht.svg.xml
-
flags/hu.svg.xml
-
flags/id.svg.xml
-
flags/ie.svg.xml
-
flags/il.svg.xml
-
flags/im.svg.xml
-
flags/in.svg.xml
-
flags/io.svg.xml
-
flags/iq.svg.xml
-
flags/ir.svg.xml
-
flags/is.svg.xml
-
flags/it.svg.xml
-
flags/je.svg.xml
-
flags/jm.svg.xml
-
flags/jo.svg.xml
-
flags/jp.svg.xml
-
flags/ke.svg.xml
-
flags/kg.svg.xml
-
flags/kh.svg.xml
-
flags/ki.svg
-
flags/km.svg.xml
-
flags/kn.svg.xml
-
flags/kp.svg.xml
-
flags/kr.svg.xml
-
flags/kw.svg.xml
-
flags/ky.svg.xml
-
flags/kz.svg.xml
-
flags/la.svg.xml
-
flags/lb.svg.xml
-
flags/lc.svg.xml
-
flags/li.svg.xml
-
flags/lk.svg.xml
-
flags/lr.svg.xml
-
flags/ls.svg.xml
-
flags/lt.svg.xml
-
flags/lu.svg.xml
-
flags/lv.svg.xml
-
flags/ly.svg.xml
-
flags/ma.svg.xml
-
flags/mc.svg.xml
-
flags/md.svg.xml
-
flags/me.svg.xml
-
flags/mf.svg.xml
-
flags/mg.svg.xml
-
flags/mh.svg.xml
-
flags/mk.svg.xml
-
flags/ml.svg.xml
-
flags/mm.svg.xml
-
flags/mn.svg.xml
-
flags/mo.svg.xml
-
flags/mp.svg.xml
-
flags/mq.svg.xml
-
flags/mr.svg.xml
-
flags/ms.svg.xml
-
flags/mt.svg.xml
-
flags/mu.svg.xml
-
flags/mv.svg.xml
-
flags/mw.svg.xml
-
flags/mx.svg.xml
-
flags/my.svg.xml
-
flags/mz.svg.xml
-
flags/na.svg.xml
-
flags/nc.svg.xml
-
flags/ne.svg.xml
-
flags/nf.svg.xml
-
flags/ng.svg.xml
-
flags/ni.svg.xml
-
flags/nl.svg.xml
-
flags/no.svg.xml
-
flags/np.svg.xml
-
flags/nr.svg.xml
-
flags/nu.svg.xml
-
flags/nz.svg.xml
-
flags/om.svg.xml
-
flags/pa.svg.xml
-
flags/pe.svg.xml
-
flags/pf.svg.xml
-
flags/pg.svg.xml
-
flags/ph.svg.xml
-
flags/pk.svg.xml
-
flags/pl.svg.xml
-
flags/pm.svg.xml
-
flags/pn.svg.xml
-
flags/pr.svg.xml
-
flags/ps.svg.xml
-
flags/pt.svg.xml
-
flags/pw.svg.xml
-
flags/py.svg.xml
-
flags/qa.svg.xml
-
flags/re.svg.xml
-
flags/ro.svg.xml
-
flags/rs.svg.xml
-
flags/ru.svg.xml
-
flags/rw.svg.xml
-
flags/sa.svg.xml
-
flags/sb.svg.xml
-
flags/sc.svg.xml
-
flags/sd.svg.xml
-
flags/se.svg.xml
-
flags/sg.svg.xml
-
flags/sh.svg.xml
-
flags/si.svg.xml
-
flags/sj.svg.xml
-
flags/sk.svg.xml
-
flags/sl.svg.xml
-
flags/sm.svg.xml
-
flags/sn.svg.xml
-
flags/so.svg.xml
-
flags/sr.svg.xml
-
flags/ss.svg.xml
-
flags/st.svg.xml
-
flags/sv.svg.xml
-
flags/sx.svg.xml
-
flags/sy.svg.xml
-
flags/sz.svg
-
flags/tc.svg.xml
-
flags/td.svg.xml
-
flags/tf.svg
-
flags/tg.svg.xml
-
flags/th.svg.xml
-
flags/tj.svg.xml
-
flags/tk.svg.xml
-
flags/tl.svg.xml
-
flags/tm.svg.xml
-
flags/tn.svg.xml
-
flags/to.svg.xml
-
flags/tr.svg.xml
-
flags/tt.svg.xml
-
flags/tv.svg
-
flags/tw.svg.xml
-
flags/tz.svg.xml
-
flags/ua.svg.xml
-
flags/ug.svg.xml
-
flags/um.svg.xml
-
flags/unknown.svg.xml
-
flags/us.svg.xml
-
flags/uy.svg.xml
-
flags/uz.svg.xml
-
flags/va.svg.xml
-
flags/vc.svg.xml
-
flags/ve.svg.xml
-
flags/vg.svg.xml
-
flags/vi.svg.xml
-
flags/vn.svg.xml
-
flags/vu.svg.xml
-
flags/wf.svg.xml
-
flags/ws.svg.xml
-
flags/ye.svg.xml
-
flags/yt.svg.xml
-
flags/za.svg.xml
-
flags/zm.svg.xml
-
flags/zw.svg.xml
-
index.html.html
-
js/app.33c5ca84.js.js
-
js/chunk-1684fe62.6be499eb.js.js
-
js/chunk-27619195.89031a5b.js.js
-
js/chunk-2ba3522d.0b719142.js.js
-
js/chunk-2d0f0c1c.f42f3bac.js.js
-
js/chunk-2d208126.71806804.js.js
-
js/chunk-2d213927.801a7c79.js.js
-
js/chunk-383adc72.e20b983f.js.js
-
js/chunk-40c6d242.c0252371.js.js
-
js/chunk-4c19539f.11bf8c9f.js.js
-
js/chunk-510960b8.b0886746.js.js
-
js/chunk-6534c7f9.c14bd912.js.js
-
js/chunk-675011d0.32369f72.js.js
-
js/chunk-746e6094.65f77ee6.js.js
-
js/chunk-7cb61fec.6f5b735c.js.js
-
js/chunk-c13ad320.6ed9129f.js.js
-
js/chunk-c9243436.29f1e477.js.js
-
js/chunk-e9be8c5c.51db5a53.js.js
-
js/chunk-vendors.4ce78b58.js.js
-
js/fail.42739fdd.js.js
-
js/user.247363bd.js.js
-
logo.png.png
-
Rhadamanthys-Stealer-main/usr/local/rhadamanthys/data/framework/cover.jpg.jpg
-
Rhadamanthys-Stealer-main/usr/local/rhadamanthys/data/framework/dist.zip.zip
-
dist.exe.exe windows:4 windows x86 arch:x86
e382229cbe1cfe84b080e0a3eda013fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateIoCompletionPort
CloseHandle
GetLastError
GetQueuedCompletionStatus
IsBadReadPtr
VirtualQuery
GetSystemInfo
IsBadStringPtrA
IsBadCodePtr
HeapCreate
InterlockedIncrement
GetProcessHeap
HeapDestroy
ExitProcess
GetTickCount
lstrlenA
HeapFree
HeapReAlloc
GetModuleHandleA
HeapAlloc
LoadLibraryA
VirtualAlloc
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetStartupInfoA
GetCommandLineA
GetVersion
InterlockedDecrement
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetProcAddress
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
VirtualFree
RtlUnwind
WriteFile
user32
PeekMessageW
CreateDialogParamW
DrawTextW
IsDialogMessageW
ShowWindow
TranslateMessage
DispatchMessageW
gdi32
DeleteObject
CreateBitmap
CreatePen
CreateCompatibleBitmap
CreateCompatibleDC
CreateRectRgn
DeleteDC
BitBlt
ole32
CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CreateStreamOnHGlobal
CoInitializeEx
shell32
DragQueryFileW
DragAcceptFiles
DragFinish
CommandLineToArgvW
winmm
timeEndPeriod
timeGetTime
timeBeginPeriod
Sections
.text Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
package.bson
-
public.bin
-
Rhadamanthys-Stealer-main/usr/local/rhadamanthys/data/framework/distex.zip.zip
-
dist.dll.dll windows:5 windows x86 arch:x86
eba2289ee6535a5f50ac3ce46595db8c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcessHeap
IsBadCodePtr
GetModuleHandleA
VirtualQuery
IsBadReadPtr
HeapDestroy
HeapCreate
IsBadStringPtrA
InterlockedIncrement
GetQueuedCompletionStatus
GetLastError
CloseHandle
CreateIoCompletionPort
GetTickCount
HeapFree
HeapReAlloc
HeapAlloc
lstrlenA
GetSystemInfo
user32
IsDialogMessageW
ShowWindow
CreateDialogParamW
DrawTextW
PeekMessageW
TranslateMessage
DispatchMessageW
gdi32
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
CreateRectRgn
BitBlt
DeleteObject
DeleteDC
CreateBitmap
ole32
CoUninitialize
CoInitializeEx
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
shell32
DragAcceptFiles
DragFinish
DragQueryFileW
CommandLineToArgvW
comctl32
_TrackMouseEvent
InitCommonControlsEx
msimg32
AlphaBlend
GradientFill
winmm
timeGetTime
timeEndPeriod
timeBeginPeriod
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
Exports
Exports
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 890B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
package.bson
-
public.bin
-
Rhadamanthys-Stealer-main/usr/local/rhadamanthys/data/framework/wwwroot.zip.zip
-
index.html.html
-
Rhadamanthys-Stealer-main/usr/local/rhadamanthys/data/private/blackips.xml.xml
-
Rhadamanthys-Stealer-main/usr/local/rhadamanthys/data/private/public_suffix_list.dat
-
Rhadamanthys-Stealer-main/usr/local/rhadamanthys/data/private/restart.sh.sh linux