Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

countrycom...ro.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f100f7610250377f7aa4aa91868764d92efb34e6b005443eb1d57883a2fcd644

  • Size

    6.6MB

  • Sample

    250208-kztqbsxlfn

  • MD5

    ec4a3f650308f2b9b65dc42ae69705c3

  • SHA1

    35bf9c7bcb9a5acd3f7382a2009b609e2af49557

  • SHA256

    f100f7610250377f7aa4aa91868764d92efb34e6b005443eb1d57883a2fcd644

  • SHA512

    30929dce268b7d2a3c810711d3d877f88280991f9caff9c5aeb7e86e6c22ced32053612024ac16f1d3c49df5ea35487f991f7e4e95ce085b2d36abdab7e91521

  • SSDEEP

    196608:PaYRJkbX1mfjnA6ZrhaERSHl2ls9SEMmd8uuAGwoR:NeKnA6Z0qSes9SELd8fAG9R

Score
10/10
rhadamanthysdiscoverypersistencestealer

Malware Config

Targets

    • Target

      countrycompetitivepro/countrycompetitivepro.exe

    • Size

      6.6MB

    • MD5

      c722efbd6781a55e940a383ade46cc79

    • SHA1

      f2f5eb63f9304c12616c8996ecd434657e2dbb78

    • SHA256

      7869837cc1a058968e44284a1f8198e529a999bcc41076105ffe98b1468ad259

    • SHA512

      d31a9b542233e32c89f4a9b0712d4cb6d39795bdb686f077b30c62601b6f4db48fa87cce4aaa52c77d3c8d5cf92103e5d017d12e326c5568050c36db552090c5

    • SSDEEP

      196608:6agJtOx1VafdnsUhfzaIzSVDsDCh6yGmBCgSUaylD:2cAnsUh+KSGCh6y5BCDUR

    Score
    10/10
    rhadamanthysdiscoverypersistencestealer

    • Detects Rhadamanthys payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Rhadamanthys family

      rhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks