Resubmissions

03-11-2024 15:35

241103-s1h9zsybln 1

03-11-2024 15:12

241103-slem9axgnm 10

03-11-2024 15:09

241103-sjrj2azmaq 4

03-11-2024 14:57

241103-sbqb1awlhx 10

03-11-2024 14:34

241103-rxqdfswjas 10

General

  • Target

    boobee.txt

  • Size

    156B

  • Sample

    241103-sbqb1awlhx

  • MD5

    32ed85782dac5ad9e97eee17d5a3bf5d

  • SHA1

    f40f564a3265f90a1f41d6ffcfddf1d735d45dbf

  • SHA256

    35dcb543ce32c17153d4401abc5da15d8c8db7b16d72c6e6dfe993eabcc87f86

  • SHA512

    dcfc8e3084551e8a3b002c62ac54b7ae750940412faff211400e27ecb3d2918392af8ad6cc00921ddf8944549e526cd539005899395af5a5227f2942b74026a4

Malware Config

Extracted

Family

rhadamanthys

C2

https://93.123.39.202:6635/ff624c8432ecf0bb1430dae/9xsism3h.1irhf

Targets

    • Target

      boobee.txt

    • Size

      156B

    • MD5

      32ed85782dac5ad9e97eee17d5a3bf5d

    • SHA1

      f40f564a3265f90a1f41d6ffcfddf1d735d45dbf

    • SHA256

      35dcb543ce32c17153d4401abc5da15d8c8db7b16d72c6e6dfe993eabcc87f86

    • SHA512

      dcfc8e3084551e8a3b002c62ac54b7ae750940412faff211400e27ecb3d2918392af8ad6cc00921ddf8944549e526cd539005899395af5a5227f2942b74026a4

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Rhadamanthys family

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks