Extracted

• • Target

    30cb3108c3ddc94267711231a6fe166f13053ae4765c37a88bfd08c8f9235f4d.exe

  • Size

    13.8MB

  • MD5

    136dbcf9a827c27791c703f31d98ffe5

  • SHA1

    f3606e2860007494475616bbf23b63812906bbd9

  • SHA256

    30cb3108c3ddc94267711231a6fe166f13053ae4765c37a88bfd08c8f9235f4d

  • SHA512

    1349cb55cb8632f99a82754b290981d6c5acee303620878d6e93d0930e3d1f61bfc9e5657350a204edd89342fbfee3007fd65bd610f3555a7aa25479f0a4281a

  • SSDEEP

    393216:cZ0P38HyS6r3LgWe+3v1jHmhyc9v9XqTZYR9iR6:ckMHyS+9lhSyaRQs

  Score

  10^/10

  rhadamanthysdiscoveryevasionexecutionpersistencestealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2

• • Target

    ⌚/otdel.exe

  • Size

    423KB

  • MD5

    fd1ac3296444a3696dc4fc1373c7bca7

  • SHA1

    93b2df42be82d79455dc1c0f0f850656ddd7e57a

  • SHA256

    13ae645002224daa84b856fa7d53f3220392d6e284c98f3d8c7f310918dc87bc

  • SHA512

    4bb9491b93b0024f8d22410af8b0e1469e1b09bb63727e8b74e3c3442a169311c7005508a26e38c41d0c8f1327e9f5f9003a7de13d7ba2ead6fb42487eb08c92

  • SSDEEP

    6144:YAYM3ZEWqf/qwPF7LR5W8ZJ74zmRiOFBbMh9q/JS63ChNeK06iiRzmi0F9:YWBqf/qq3R5W8ZB4zmRzbatsViRUF9

  Score

  1^/10
  behavioral3behavioral4

• • Target

    ⌚/withrobot.exe

  • Size

    14.8MB

  • MD5

    02071fe1b9c8d6ade8dafa0a71600503

  • SHA1

    5b547e72386e43c291bceea5b7d0e8f51469cd3c

  • SHA256

    00c32e90c14f9c866a30256c8499e753397c7385e4a3fbcdc86515b9ee563faf

  • SHA512

    1c4b1c1cb788f08dea954b795d4e0bbd7c028aa5655ce23af805243d06d1c96ef687b0788343182c1d0307e9c76088e4d53e4506e5a4f8d1707001e6549b487a

  • SSDEEP

    393216:9kmzxXRKFz5EKqq7EBCuE/FFicGW8bBekvN:97xXRKFdlP9ijbBvv

  Score

  1^/10
  behavioral5behavioral6