Extracted

• • Target

    6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe

  • Size

    13.8MB

  • MD5

    371e947f5d28b083c86a5db933d392a0

  • SHA1

    0855077258e3377f4af707ab0e33818799187234

  • SHA256

    6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630

  • SHA512

    9fafbaecdbdff56484e189fcec575e2a23c38b8054ed5d8206982b9b8650f5bbec2990e710a29a1134a53c060a2c2cd85b3fba6fac718c5bb213a7cea9403184

  • SSDEEP

    393216:cSXdOirfXtcAxWCigfnjhxqFEzHVNuXvufFJi0+0mxIMLvVFJeEMQbJAQdZ:cyLrfXtZxWLAjPqGzVNGu6xPSmVFJDMa

  Score

  10^/10

  rhadamanthysdiscoveryevasionexecutionpersistencestealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2

• • Target

    ⌚/maaxx.exe

  • Size

    423KB

  • MD5

    b06511bb7fd960041b3feed3eb41ba10

  • SHA1

    83eae46ba9f85fa7380411aff1745d6476fad1c9

  • SHA256

    e74aeaf93a550857cbf3d1fe9d13c420919c4d92ea9c7b2e0ce580ae8057955f

  • SHA512

    ad6c1c4bdb45db4baafc3fa3c49d998a8b8adf70a4a71b3739fe890fdc4c47c3f2cfc9bb97049492177a07e8a025405b78990283f27df9136cf35e0f56f31030

  • SSDEEP

    6144:YAYM3ZEWqf/qwPF7LR5W8ZJ74zmRiOFBbMh9q/JSGx3ChNeK06iiRzmi0F9:YWBqf/qq3R5W8ZB4zmRzbaqIsViRUF9

  Score

  1^/10
  behavioral3behavioral4

• • Target

    ⌚/withrobot.exe

  • Size

    14.8MB

  • MD5

    02071fe1b9c8d6ade8dafa0a71600503

  • SHA1

    5b547e72386e43c291bceea5b7d0e8f51469cd3c

  • SHA256

    00c32e90c14f9c866a30256c8499e753397c7385e4a3fbcdc86515b9ee563faf

  • SHA512

    1c4b1c1cb788f08dea954b795d4e0bbd7c028aa5655ce23af805243d06d1c96ef687b0788343182c1d0307e9c76088e4d53e4506e5a4f8d1707001e6549b487a

  • SSDEEP

    393216:9kmzxXRKFz5EKqq7EBCuE/FFicGW8bBekvN:97xXRKFdlP9ijbBvv

  Score

  1^/10
  behavioral5behavioral6