Extracted

• • Target

    4376c7ba6929c92cb67e488f22238b2b66f0ba593d339493afb6cc79eecd0060.exe

  • Size

    13.8MB

  • MD5

    135dfcaa5528b7b142b1eaf2ff1c0e12

  • SHA1

    dd627df5ce8f16a9223bcada97e2137869f6e017

  • SHA256

    4376c7ba6929c92cb67e488f22238b2b66f0ba593d339493afb6cc79eecd0060

  • SHA512

    0a62c0be7220d03c53aa66ae676bb7b59cc84161671ab9f9cfa09fa71059aff4161bf24be04780f7d930fa8e9dbf5b9383d407e97df88f860c134d595bee3896

  • SSDEEP

    393216:cwV/LcRDX5ADxbV7UEtydTCNUB6InvPmRFv591NUtiJ:cMCD5KTxydTsUB6IgJ5pUtc

  Score

  10^/10

  rhadamanthysdiscoveryevasionexecutionpersistencestealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2

• • Target

    ⌚/dhrfsdfr.exe

  • Size

    423KB

  • MD5

    f75fd41b890f7d1915656eb3c349d231

  • SHA1

    a6dac338a2c4118b0b642560a1c0b1d6f10863c9

  • SHA256

    069c13063d9f5a0792437bf219b30dd2e3c6c1fa498970ad61505571bbdf1adc

  • SHA512

    24f2c673f5530bf09b66d8ea591d869e2625b91cf3d3953f6a75052fa18b16b71ae35730b2de1b11760d22e686b23716945b50da46481bd92b65f757f6222716

  • SSDEEP

    6144:YAYM3ZEWqf/qwPF7LR5W8ZJ74zmRiOFBbMh9q/JSi3ChNeK06iiRzmi0F9:YWBqf/qq3R5W8ZB4zmRzbadsViRUF9

  Score

  1^/10
  behavioral3behavioral4

• • Target

    ⌚/withrobot.exe

  • Size

    14.8MB

  • MD5

    02071fe1b9c8d6ade8dafa0a71600503

  • SHA1

    5b547e72386e43c291bceea5b7d0e8f51469cd3c

  • SHA256

    00c32e90c14f9c866a30256c8499e753397c7385e4a3fbcdc86515b9ee563faf

  • SHA512

    1c4b1c1cb788f08dea954b795d4e0bbd7c028aa5655ce23af805243d06d1c96ef687b0788343182c1d0307e9c76088e4d53e4506e5a4f8d1707001e6549b487a

  • SSDEEP

    393216:9kmzxXRKFz5EKqq7EBCuE/FFicGW8bBekvN:97xXRKFdlP9ijbBvv

  Score

  1^/10
  behavioral5behavioral6