Overview

overview

10

Static

static

1

start.bat

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    start.bat

  • Size

    32B

  • Sample

    250210-r3qleawjc1

  • MD5

    bf24697b5cb868ee7a5ddd4809d45dbc

  • SHA1

    716a502d0392c6bbdc770f4146b995575f259373

  • SHA256

    6e722243696a6525fe5e873b77f5069fd5c6c7e9147d8a69a13675c67211e892

  • SHA512

    91c1f63a4337e19c7009892fe697b476b007e6d554afd5668bfdbb853a0874a6b91567340e87d9c18a58d7b99e059edb61048cf417eff3a7ea02cbfd83771082

Score
10/10
rhadamanthysdefense_evasiondiscoverystealer

Malware Config

Targets

    • Target

      start.bat

    • Size

      32B

    • MD5

      bf24697b5cb868ee7a5ddd4809d45dbc

    • SHA1

      716a502d0392c6bbdc770f4146b995575f259373

    • SHA256

      6e722243696a6525fe5e873b77f5069fd5c6c7e9147d8a69a13675c67211e892

    • SHA512

      91c1f63a4337e19c7009892fe697b476b007e6d554afd5668bfdbb853a0874a6b91567340e87d9c18a58d7b99e059edb61048cf417eff3a7ea02cbfd83771082

    Score
    10/10
    rhadamanthysdefense_evasiondiscoverystealer

    • Detects Rhadamanthys payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Rhadamanthys family

      rhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Enumerates VirtualBox registry keys

      defense_evasion

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Looks for VMWare services registry key.

      defense_evasion

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks