Overview

overview

10

Static

static

1

BootstrapperExec.exe

windows7-x64

10

BootstrapperExec.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BootstrapperExec.exe

  • Size

    120.0MB

  • Sample

    250206-1e8azsxnh1

  • MD5

    9b5895f9fd9b9db54f1568546610333b

  • SHA1

    81ee063d90dadca3e030c358e47d373406d8a0fb

  • SHA256

    275abb4ef28e545fb85f8db9b252d1a9ee88125c85dab777f2e01f74b4e4ca07

  • SHA512

    4d3a5cda98d4e8c9877eada9f1406cbc4b5c986903405d4131a018c81122815901e04323c3f9c42006e039ca35f3f41c477a23d373cb3e6af655285ab2c0c495

  • SSDEEP

    24576:0LXWbte6Ooz/0xef3/PJZGhEl/9XDcFPMu9YXMgmRJEmgChVYwBV7OTNVTpP:pbte61zQeHP/xXCIXSEnAFBV7mXF

Score
10/10
rhadamanthysdiscoverystealer

Malware Config

Targets

    • Target

      BootstrapperExec.exe

    • Size

      120.0MB

    • MD5

      9b5895f9fd9b9db54f1568546610333b

    • SHA1

      81ee063d90dadca3e030c358e47d373406d8a0fb

    • SHA256

      275abb4ef28e545fb85f8db9b252d1a9ee88125c85dab777f2e01f74b4e4ca07

    • SHA512

      4d3a5cda98d4e8c9877eada9f1406cbc4b5c986903405d4131a018c81122815901e04323c3f9c42006e039ca35f3f41c477a23d373cb3e6af655285ab2c0c495

    • SSDEEP

      24576:0LXWbte6Ooz/0xef3/PJZGhEl/9XDcFPMu9YXMgmRJEmgChVYwBV7OTNVTpP:pbte61zQeHP/xXCIXSEnAFBV7mXF

    Score
    10/10
    rhadamanthysdiscoverystealer

    • Detects Rhadamanthys payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Rhadamanthys family

      rhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks