General

  • Target

    AstralRust.rar

  • Size

    237KB

  • Sample

    241119-pt3hhawhnq

  • MD5

    1a95c1cf9372a2e4f80a8519a5afab25

  • SHA1

    7268b000b587ee38d2d6d750b10eff9f94529fbd

  • SHA256

    4c7b248106f9d66630e2975e09102174f36780f5a441eb51d6415afc0249692e

  • SHA512

    4e532a4700f6a5fad1d189c07a8eadc06a08d7bd60933e480dc42bfde216a0698d6096c86b565898cd6531c7ea74c1b9b75852e8e513f1c551395a78abbc4ac5

  • SSDEEP

    6144:qGu1L/dS7hcMiM8oCH3rD9bFufV9EXVvg1IOE2BclY6rHDAG:Xu1zdIcMmpQd9+hy+jAG

Malware Config

Extracted

Family

rhadamanthys

C2

https://185.125.50.38:3034/739bd3e91cd40ca83/lem.api

Targets

    • Target

      AstralRust.rar

    • Size

      237KB

    • MD5

      1a95c1cf9372a2e4f80a8519a5afab25

    • SHA1

      7268b000b587ee38d2d6d750b10eff9f94529fbd

    • SHA256

      4c7b248106f9d66630e2975e09102174f36780f5a441eb51d6415afc0249692e

    • SHA512

      4e532a4700f6a5fad1d189c07a8eadc06a08d7bd60933e480dc42bfde216a0698d6096c86b565898cd6531c7ea74c1b9b75852e8e513f1c551395a78abbc4ac5

    • SSDEEP

      6144:qGu1L/dS7hcMiM8oCH3rD9bFufV9EXVvg1IOE2BclY6rHDAG:Xu1zdIcMmpQd9+hy+jAG

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Rhadamanthys family

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks