General

  • Target

    LockBit-main.zip

  • Size

    3.4MB

  • Sample

    241125-tfl1tavjhv

  • MD5

    48c928de6458fac060c281e3febc1a15

  • SHA1

    e6ed8102960a159063edd62695926d16be32ce60

  • SHA256

    ff652f97ac93507e30fca7446d266d82e5ad1ca4066b1e5dc81b5e3256e393b4

  • SHA512

    01abc3d99d8ecb19991a0a70c5e10fb4b86b70edcf1492d9827edd72e70fb1c2596ab6e49261bc31965fb68be8749fb622bf3050458eb44aec9230f567228daf

  • SSDEEP

    98304:1TKYu1ibTKwig1isTKQTK3D1i5I39BPiv12FpQiwilbl4:1OYu1sOng1tOQO3D1CI3Tg1epQiwsba

Malware Config

Extracted

Family

rhadamanthys

C2

https://195.3.223.126:4287/9d0dc091285eb9fbf2e/o8f3c8oj.8rdif

Targets

    • Target

      LockBit-main.zip

    • Size

      3.4MB

    • MD5

      48c928de6458fac060c281e3febc1a15

    • SHA1

      e6ed8102960a159063edd62695926d16be32ce60

    • SHA256

      ff652f97ac93507e30fca7446d266d82e5ad1ca4066b1e5dc81b5e3256e393b4

    • SHA512

      01abc3d99d8ecb19991a0a70c5e10fb4b86b70edcf1492d9827edd72e70fb1c2596ab6e49261bc31965fb68be8749fb622bf3050458eb44aec9230f567228daf

    • SSDEEP

      98304:1TKYu1ibTKwig1isTKQTK3D1i5I39BPiv12FpQiwilbl4:1OYu1sOng1tOQO3D1CI3Tg1epQiwsba

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Rhadamanthys family

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks