Extracted

• • Target

    0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6.exe

  • Size

    13.8MB

  • MD5

    59528f2fe5b0f3fa8dc4b39552b13250

  • SHA1

    aad3b825d26a11fd6100011708b5b8a1b4877f83

  • SHA256

    0465e7a2189be75275b7ffa6fccbea59a4edb0bb3411137488a30427194725a6

  • SHA512

    5be6a290a806475ec45b27d5487ec508b98fb8cc2abf14abc5a618f847555ddc0dce8b21d167625dabe828b11903336040fa91c08b9de9c7e7299fc6c7c82e17

  • SSDEEP

    196608:s7WP+V6eGTQu75LbenTh5gOGCg+jCp5nzc74SLSbETVF4JnRXb+2IyVa1QSLr0fU:saWV6eGFtWFHxWbSnJFgtbIHfLr252tB

  Score

  10^/10

  rhadamanthysdiscoveryevasionexecutionpersistencestealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2

• • Target

    ⌚/gssgsg.exe

  • Size

    423KB

  • MD5

    da861aca3a436392e0fcb1a1b5135727

  • SHA1

    69d97208285a41cd9c3d6228ad1edc634cc3df0a

  • SHA256

    bc57668066ddb1ec774e502213af0b10c23d4a1f409199109617e750784c8410

  • SHA512

    7d0ff69678b337dce46fbb7e54f602e365bc4d9ba93c24b1dba5aee6a6040a410cefe66679ed8fb2e8cf633a1a72e37d2daf8005dfe54289ba5948e55d574957

  • SSDEEP

    6144:YAYM3ZEWqf/qwPF7LR5W8ZJ74zmRiOFBbMh9q/JSw3ChNeK06iiRzmi0F9:YWBqf/qq3R5W8ZB4zmRzbaXsViRUF9

  Score

  1^/10
  behavioral3behavioral4

• • Target

    ⌚/withrobot.exe

  • Size

    14.8MB

  • MD5

    02071fe1b9c8d6ade8dafa0a71600503

  • SHA1

    5b547e72386e43c291bceea5b7d0e8f51469cd3c

  • SHA256

    00c32e90c14f9c866a30256c8499e753397c7385e4a3fbcdc86515b9ee563faf

  • SHA512

    1c4b1c1cb788f08dea954b795d4e0bbd7c028aa5655ce23af805243d06d1c96ef687b0788343182c1d0307e9c76088e4d53e4506e5a4f8d1707001e6549b487a

  • SSDEEP

    393216:9kmzxXRKFz5EKqq7EBCuE/FFicGW8bBekvN:97xXRKFdlP9ijbBvv

  Score

  1^/10
  behavioral5behavioral6