Overview

overview

10

Static

static

1

19bad3275a...fd.ps1

windows7-x64

7

19bad3275a...fd.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    19bad3275a0cd1caa9a8eb75d496eaa897ca4c7a07aeab78ab3309d91b4f64fd.ps1

  • Size

    2.5MB

  • Sample

    241129-cleegsvmck

  • MD5

    7c2e9489af70d3967960dbe1cb87f4ae

  • SHA1

    bcade1f31f869e58848c09cd022652b612580daf

  • SHA256

    19bad3275a0cd1caa9a8eb75d496eaa897ca4c7a07aeab78ab3309d91b4f64fd

  • SHA512

    9d910243fa5847046dd6793465d5b84c2e1f72d7d42acd5e52860f9bd3545b25e981322a312930a192dd43bafe3c5679657699a78bc98f48b4b6a2aec447a374

  • SSDEEP

    1536:7Ic2Lo8L+bTXe26vgn00oR/S7rV521Gd9AcaMorjFN4UAjtbTliBdIpjXClBEv7l:ZD1

Score
10/10
rhadamanthysdiscoveryexecutionpersistencestealer

Malware Config

Targets

    • Target

      19bad3275a0cd1caa9a8eb75d496eaa897ca4c7a07aeab78ab3309d91b4f64fd.ps1

    • Size

      2.5MB

    • MD5

      7c2e9489af70d3967960dbe1cb87f4ae

    • SHA1

      bcade1f31f869e58848c09cd022652b612580daf

    • SHA256

      19bad3275a0cd1caa9a8eb75d496eaa897ca4c7a07aeab78ab3309d91b4f64fd

    • SHA512

      9d910243fa5847046dd6793465d5b84c2e1f72d7d42acd5e52860f9bd3545b25e981322a312930a192dd43bafe3c5679657699a78bc98f48b4b6a2aec447a374

    • SSDEEP

      1536:7Ic2Lo8L+bTXe26vgn00oR/S7rV521Gd9AcaMorjFN4UAjtbTliBdIpjXClBEv7l:ZD1

    Score
    10/10
    executionpersistencerhadamanthysdiscoverystealer

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Rhadamanthys family

      rhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks