General

  • Target

    Software.exe

  • Size

    442KB

  • Sample

    250104-bkp9xsvrfr

  • MD5

    55a3d0312c376ed1db15e85430f8ec59

  • SHA1

    b981f13a8586870aa4fddcf981653392f2bbbfc6

  • SHA256

    66ead826c7d71057741fa77c22db4b59e005bf009f7f190098cda30efb89ea0f

  • SHA512

    c06c09aae467d298589e125d68803d9909b4e981ed4748454663fb6538fdded6feec6203ae3a3c63edd42901089f4141dab0a55e8585ed452aeee131942c46c2

  • SSDEEP

    12288:HZ1uBVUVFZ+xnj2atdITN1qKGuQy7wsfb6hce9AB9B:HZ1anj2atdITN1q5uQK6uzB

Malware Config

Extracted

Family

rhadamanthys

C2

https://135.181.4.162:2423/97e9fc994198e76/cq4mk2ms.xrf3c

Targets

    • Target

      Software.exe

    • Size

      442KB

    • MD5

      55a3d0312c376ed1db15e85430f8ec59

    • SHA1

      b981f13a8586870aa4fddcf981653392f2bbbfc6

    • SHA256

      66ead826c7d71057741fa77c22db4b59e005bf009f7f190098cda30efb89ea0f

    • SHA512

      c06c09aae467d298589e125d68803d9909b4e981ed4748454663fb6538fdded6feec6203ae3a3c63edd42901089f4141dab0a55e8585ed452aeee131942c46c2

    • SSDEEP

      12288:HZ1uBVUVFZ+xnj2atdITN1qKGuQy7wsfb6hce9AB9B:HZ1anj2atdITN1q5uQK6uzB

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Rhadamanthys family

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks