Overview

overview

10

Static

static

9

Release/Ne....3.exe

windows7-x64

10

Release/Ne....3.exe

windows10-2004-x64

10

Release/au...in.dll

windows7-x64

3

Release/au...in.dll

windows10-2004-x64

3

Release/lo...ng.dll

windows7-x64

1

Release/lo...ng.dll

windows10-2004-x64

1

Release/lo...ng.dll

windows7-x64

1

Release/lo...ng.dll

windows10-2004-x64

1

Release/lo...ng.dll

windows7-x64

1

Release/lo...ng.dll

windows10-2004-x64

1

Release/lo...er.dll

windows7-x64

1

Release/lo...er.dll

windows10-2004-x64

1

Release/lo...-1.dll

windows7-x64

1

Release/lo...-1.dll

windows10-2004-x64

1

Release/sc...fig.js

windows7-x64

3

Release/sc...fig.js

windows10-2004-x64

3

Release/sc...al.dll

windows7-x64

3

Release/sc...al.dll

windows10-2004-x64

3

Release/sc...wp.dll

windows7-x64

3

Release/sc...wp.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Release.zip

  • Size

    25.4MB

  • Sample

    250201-nnnxgszncx

  • MD5

    86fac2461207e6672f2dd7d2c1499693

  • SHA1

    2da846dbfe30ad4f4d0e0b9666ddf819b2bee3b3

  • SHA256

    2596ce84f291c7ee4b60d32329e4926830617365e4206905b4ab7ae4987f3caa

  • SHA512

    a3636c8abd73c31807d03b2de9fa0389a5f9cead561977b999a8d1bf05e99eb02613df812596335bba4aad8d8443db8ef624b86dbd1ec6a4877b3ca10b50d90c

  • SSDEEP

    786432:MfJXn8R2+ph4UpwTUP9vGjLXg8ViqL+yla6GMnH5Rxac:4h+pppTvqjg8D++a6GyRAc

Score
10/10
rhadamanthyscryptonediscoveryexecutionpackerstealer

Malware Config

Targets

    • Target

      Release/New V1.0.3.exe

    • Size

      1.2MB

    • MD5

      bb51d554e3b4fd7fed2bad278b9970d0

    • SHA1

      7d6f516b0755b2472bfb39d086da0106a8eb3e68

    • SHA256

      1fb66beef1b9185abbf99a473188a755a0dee0e122a066a0e0776e251d716f95

    • SHA512

      acafe93c075c71b94ab3efacaec6dd168986d2a88b330958e57647adaca4e043a5ea538bb0007ba8685925c8373fda6a3d99c59c9f30f65de8fc948e2304efac

    • SSDEEP

      24576:lsKH7wrz1OIcJhiTKGOwD8HxgQotG411iS4QZl+5nLHoWLb57BW21wRqNb:rjIcJhrJxgQHPS42sHoWH9QuA+

    Score
    10/10
    rhadamanthysdiscoverystealer

    • Detects Rhadamanthys payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Rhadamanthys family

      rhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

    • Target

      Release/autoexec/bin

    • Size

      18.7MB

    • MD5

      88fd7dbf04bcf75123d02009aea3f7f7

    • SHA1

      cecf16bdad71e54afc941179ea2b7438a04efa1d

    • SHA256

      01481b9a862936fbc090bda4033f22d7ffa5a7bfe5dc32f47c7794332b34eec4

    • SHA512

      2c6298b5adf91b51f0042d48e0846f5b196d52a588fd4fc577bf19ec26ad8e547382279a15f8bf131b08b0d7c140534aff25f82d5e8998818b812e72c9493917

    • SSDEEP

      393216:hqA/D2IIyzg8DolBo6i0KoI6Di42sC1/syU3DXNs6hq8:hqcaZyV0fC1JOpjhq8

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      Release/locales/resources/app.asar.unpacked/node_modules/btime/binding.node

    • Size

      118KB

    • MD5

      13a2579ed95366185a6247c9e4b9f0cc

    • SHA1

      61fef12da622484e44b3c9ddcd61706c9af00aa0

    • SHA256

      98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f

    • SHA512

      7aae5a45f5333355c81e4a7468d40c9d814a1b242c99a39747fea9b66e277dd1060bda290fc980e958beccab2ac0232fc4aba078426ac5ae39c19968ae8f58d0

    • SSDEEP

      1536:OMwHUFyUCyB7KdX2teZOpSPtvdO+tYLZI2mAq+J6sWyd09dlgh7tBrdO6t2:hwjUCyB7eC8OpSS+tYLZI5+NMKFdO6t

    Score
    1/10
    behavioral5behavioral6

    • Target

      Release/locales/resources/app.asar.unpacked/node_modules/get-fonts/binding.node

    • Size

      125KB

    • MD5

      eeb1d1ea9fc3f870f292161cfa79850d

    • SHA1

      ea4f4324245f9f4d6280ef285151f688221d6023

    • SHA256

      149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c

    • SHA512

      795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254

    • SSDEEP

      3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG

    Score
    1/10
    behavioral7behavioral8

    • Target

      Release/locales/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.node

    • Size

      118KB

    • MD5

      6c12c930f974e5bc7872b58964f42359

    • SHA1

      805c5c899c32535d2ee8b2bc12deefe5fdaae566

    • SHA256

      094bfeb0692885f1e56bb363e1065099eab48a7988c8603fd6a3fb49ec88b09c

    • SHA512

      f46c416e3f33e0526c2d4cb3df738f7c9b11fece350b90ca9613e5d86bae7a363dd20b80d62f5745a9d51773b655199537b09fcf47acf226f35002f39f1596d3

    • SSDEEP

      3072:/WKjx2yp1tLqA1HB4kdeRqGmX5EMMi6leGS:3xBPVf1HB4kER4UFhS

    Score
    1/10
    behavioral10behavioral9

    • Target

      Release/locales/resources/vk_swiftshader.dll

    • Size

      4.8MB

    • MD5

      98cd947cb91f60c944b46c612ba732b1

    • SHA1

      6b4de1cd559ceeee8781c19e84a68a8759cff9d3

    • SHA256

      fdb59038b414deaaa96bf0744abd7a7d4fb36fd59bb2c3b36f71e5a2cc9c8d82

    • SHA512

      a262deb3683c93492bfb2467c539cdf8df5f684d49c4c78770ebfc62ae8a949f6b9a18497d377d62cd5231d0eca9994c6b5e7b0885ffed787bcff1ad41669999

    • SSDEEP

      49152:eveyoM/h2BPSjPJEvoSNxxJanAf9dX2kcngUkomWPG2pu6n9MT5F9AZCeqx7l1Zx:cQM/agZaHt7A4P//

    Score
    1/10
    behavioral11behavioral12

    • Target

      Release/locales/resources/vulkan-1.dll

    • Size

      880KB

    • MD5

      0971bc5ea027dba6fb7e0e39713c9b64

    • SHA1

      fef070d731e910131ce4474e4b22b123749de3c7

    • SHA256

      c7d946d9585a856abe6201e2ddb128e6dd2a376950c375e5d09a4f1f0f0ad792

    • SHA512

      03e7bf839720b37a69b1e87779f552609a6df73913ecbb3a1baa8a814902ff563ba2a55eb95811a368d02cd93fa1d5a0d657ffbce9f8609474d4d7a6b6936db3

    • SSDEEP

      12288:mefVW1lX8MvG9E0wsYox2Nmp6yWEaAT6bJUQzH3To+4AEir1iSozbz:mOcTX8p20wsYHmXaATmXjvFozbz

    Score
    1/10
    behavioral13behavioral14

    • Target

      Release/scripts/config.txt

    • Size

      220KB

    • MD5

      96c673c9e9dedefec5fd5e27284e4f29

    • SHA1

      1b5865f8998749a1fd61f62e6357d19dedcc9a2c

    • SHA256

      d92b9e01e24935e1cc6144734c0b39379edef1e3c06aedbd547dc304e7334d77

    • SHA512

      4ac805e8528f1003911960ce317150d186022a30dc31c479a54e1f6adbbf9cbce882da4b46f8cf0991c9e07fb4239f970d07c1538e4d16c79b560b5b272e5b83

    • SSDEEP

      3072:ubmjIIxdmqlnRf1/QyZs2WWwjojiS06SK9J8Iq8jltsBo0FXnihq/+43j:uBCdFllFLsSok9Jg4lutNb+4T

    Score
    3/10
    execution
    behavioral15behavioral16

    • Target

      Release/scripts/local

    • Size

      18.7MB

    • MD5

      88fd7dbf04bcf75123d02009aea3f7f7

    • SHA1

      cecf16bdad71e54afc941179ea2b7438a04efa1d

    • SHA256

      01481b9a862936fbc090bda4033f22d7ffa5a7bfe5dc32f47c7794332b34eec4

    • SHA512

      2c6298b5adf91b51f0042d48e0846f5b196d52a588fd4fc577bf19ec26ad8e547382279a15f8bf131b08b0d7c140534aff25f82d5e8998818b812e72c9493917

    • SSDEEP

      393216:hqA/D2IIyzg8DolBo6i0KoI6Di42sC1/syU3DXNs6hq8:hqcaZyV0fC1JOpjhq8

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      Release/scripts/uwp

    • Size

      4.2MB

    • MD5

      b0f566fc20de341e2848a489f69a4e48

    • SHA1

      7a81ab4c68ddeb1e0a83c37e17286ae53e29c334

    • SHA256

      5223f453b44be5d13f5f249f1f23b020b75c7e237c23712d97813c430015afc6

    • SHA512

      4ba8394bede49de1dd1ad98afa59e0546b5118cf6b75dcf2cc83f00fde88bda0d659944c3324d19960d935d9e29e69f8b9b08fa5d5db7f71506e13471bbcb75f

    • SSDEEP

      49152:LikvPpFjV8b8bhnNcZXGDQc6jg8mHdnYvLyv5ttr24Y4AxYWAF7yWGxmR/qSDQey:0ZXGU7k8Ol5/24PqNmOQ

    Score
    3/10
    discovery
    behavioral19behavioral20

MITRE ATT&CK Enterprise v15

Tasks