Resubmissions

12-02-2025 17:50

250212-wekgps1ndp 8

12-02-2025 17:48

250212-wde6la1nbp 10

12-02-2025 17:45

250212-wbz3zs1qaw 3

General

  • Target

    ROBLOX Cheat.zip

  • Size

    14.1MB

  • Sample

    250212-wde6la1nbp

  • MD5

    77612ae23f6eb446aed45201590f8d5d

  • SHA1

    bf75734ae442e3e3bacc0b26fbc8edb67bf67705

  • SHA256

    1e7bf1aa6b91a6626f5633b5588fc713a2188ba4a1abba445ad531f106a5dabe

  • SHA512

    05cc5fc40774078266f7c58aea66a179555e558d8fada2066e24a736fade4934e065756f9502da5e2062c0f6075948ad43626047de7e8b4657e51d3e74552e34

  • SSDEEP

    393216:0XG3+iho0r4nMrJz+sNVDAyqQpYQSK4Wka8R:WtK4neJSsNVWQpYE78R

Malware Config

Targets

    • Target

      SoftWare(1).exe

    • Size

      3.1MB

    • MD5

      09776d1e6b458622944c21a37127d945

    • SHA1

      55fe43db0038a411d1302b85cb1d8c61704bf2a4

    • SHA256

      6718e20d2fcaed405be6cb6784e6df72d93e5449fbab18e4d2d1dec5e2efde0a

    • SHA512

      e530a84c2bf855f8ed7ec667f12dd738c0af4a6f63efb861432065634d4d5afb5e8369d28e1c90753efe5ed24bbf384ac5e20819efdc3b73735a31fce7e83d07

    • SSDEEP

      49152:SZQQYNwNfHO8dkHOL+/4n5TlqmjPEY5XlPHXc1jbIEXVQ7IiVVNSrUWTKtOd/o06:SdHSwn5eY5V2bd8b

    • Detects Rhadamanthys payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Rhadamanthys family

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Suspicious use of SetThreadContext

    • Target

      SoftWare(2).exe

    • Size

      371KB

    • MD5

      2569020b4f537d6bfe2c65ef058f5c81

    • SHA1

      380b0299db8c4e24b5485fc703e612adb9b5b638

    • SHA256

      8b642d18712bec1c4388be2de24f7a8abcfe4bdea72b39cc0f0df484828afd3f

    • SHA512

      5e4397875992c74daa14ca44351dd6cb871543bddfee8438ffaaf9d7c9ba7cca4816a0af210ab28a2328ee8549d9c045180a25ea0b3a042613b81c4c9dfb48a1

    • SSDEEP

      6144:Pn31Zi9rAs2tOr9a/Tg4Z7tIFkkPGH04a/c8g8koJh9uEOw6/pFYJZctsVPfcjyM:P31Zi9rA/qa/Tg4B96y0zxJkshtOw+Fz

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

    • Target

      atom.dll

    • Size

      3.1MB

    • MD5

      1569785bfb346bca69521f03a8725f41

    • SHA1

      0197e299cce7adb9856e2f0d458c4f995898fb55

    • SHA256

      9a89cf1428bbba42ea97e747485eabebd0f3116e9287fd8bbe9e5e383bc91d98

    • SHA512

      648a98491358bd73009354f418f782179c19489be7d4383e726c965ae2f9016006144a9d40fadc8ca6ab65c3883897f5a0dfb884580ed6699f30144d5c931ff4

    • SSDEEP

      49152:4Z294FkBxwSfyRzgsbbAf2F1b7521Ire5AT3:4iQnAfG1P5Ze23

    • Detects Rhadamanthys payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Rhadamanthys family

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Suspicious use of SetThreadContext

    • Target

      brand.dll

    • Size

      204KB

    • MD5

      916d89b5d24979190fd8b5b5795230a2

    • SHA1

      42515c9b2aa015be9a3c8942b76bb119ff1c318a

    • SHA256

      fd6bfe231d47a831c5e0f8a65fd264636710e30f5c611176de2b341d92f12df8

    • SHA512

      c9a6909c6f781d974282f62824b9f2cc21bbc8c11fc03c09c40d97295ea8977c31bb11c0cf2eae2765ecd6e8a9e67b57345a20db85102339ac5b49200301077c

    • SSDEEP

      3072:yyN5t1veJLGufnflehMvmldBTlqlAO/bmDx3g0RDlYSkEo3z/VrTsyFqug:yyfvveJLhyMvmgv0haSe3z9rTsyF3g

    • Detects Rhadamanthys payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Rhadamanthys family

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

    • Target

      concrt140.dll

    • Size

      325KB

    • MD5

      eb42b164d603672e07997019bb00e4ad

    • SHA1

      9f73f2323b167215874a7d3dd4a7f7750312f219

    • SHA256

      dabdb0732b2fc14040cedbbfd369d9eb3c7a2e66b38a79892e1c05e6d6a8526d

    • SHA512

      1e74ea24bfcaa5dd1ef0654a45f96c99900dbfca406bcfb73ae3abfdad7c1d0d12e773817a9ab3fd8d1d927a85d5fa6447b3c521192dccf33957f5bea00b3cc8

    • SSDEEP

      6144:1ndGd0wl7XIbBx5C9YtkO2MUWghMWbGynWzgcZ6rO4i47:zCpIRC6tcG5zKiU

    Score
    8/10
    • Downloads MZ/PE file

    • Target

      encoding-conversion.dll

    • Size

      28KB

    • MD5

      b0f21ea663476cbf02a93b8de7152586

    • SHA1

      b6253d151a6d88ecf7029e79bbe4737792dfa79d

    • SHA256

      249e70a3bf203692e2212ede45fdefecafaede7ab9fa6cefcf02a65f0e14cbe7

    • SHA512

      59fcddc5b4a87efca72a9a7c1252701c57ba65c656958d9c0a5557c3ffd049fcfeb10d6ddfeca8e33171cd269c03bb19ecbb5e7e9a25e664e1b26c81211db1c1

    • SSDEEP

      384:FibcYRa//wXJg3s4h+hh0cTGfZihL0cTGfZVhm:jCLOph+hhTwiNTwVhm

    Score
    3/10
    • Target

      icudt68.dll

    • Size

      19KB

    • MD5

      994a66f27812c53d3f5bd8336b4a2aa4

    • SHA1

      e4575dd22d14cd9704d0b34d2d0ddeac54c90637

    • SHA256

      ce1ba6d19bd4842fb54daf9d929208b3840ec98e3a135bd89008dd9312f03894

    • SHA512

      d2ecf75afc628026e0f10cd58869cfe8b7dd85e401b544a9e5b0a3a26e5518883b3d5bd03160301b4d927f20b983b403fd514a7c7762b70ba19c9feb9258f3f7

    • SSDEEP

      192:tSU/lU0TBZHh0Fg2kAdGlYqufZnixMa4bbP0Fg2kAdGlYqufZnltBZHVd:VtVhh0cTGfZSMPj0cTGfZ1hX

    Score
    3/10
    • Target

      icuuc68.dll

    • Size

      2.1MB

    • MD5

      95482a6a29f2d531732294b10f35a684

    • SHA1

      7bf324f137d085d7ff5431df0d12208f42b8217b

    • SHA256

      5f56fea8807d97052e8dfe3bb25baf7ad0200d7cb288a8b3e9aef4d8881367b8

    • SHA512

      4f6abeb8a2227ab30ae9aaa131408d1f6d737f38a1f0ef1b691cd20c40b756fdafa94bcf5413f49bb251187166574d03601e809601b487d6327c407034e98bcd

    • SSDEEP

      24576:LE4CsQBmuuq+7QJHOqHsEehOB1TTCbKJM9lo736S1GBAdtkjsyk3lIkkp1sTf9wY:4sQ9+qHOIBehOB4mulo736uGCrykVYlO

    Score
    6/10
    • Downloads MZ/PE file

    • Target

      libcrypto-1_1-x64.dll

    • Size

      3.3MB

    • MD5

      5bbead1078ba0b07e0766eb2426167eb

    • SHA1

      c3443ea0a003268c022225e9b85c6edfb2c09607

    • SHA256

      0cfa2871aa30c9e047a8f5266b31f548b343f15244d26be26bb2a070b5655237

    • SHA512

      55b98d8b57bf06ff9718a73dffb11a3c666c2ba24964b8a9b3c540d4faa22e3aa5dd284795b97375edeb845b7b83dca89bcc97d44c2f66886d5c5b56ff532902

    • SSDEEP

      49152:aVwASOxVIU6ix4GtlqcD+edG2uGAxq+qJhT/XtJl7Ec6YBE6yPBsosKL1CPwDv3G:0y+/rA0lBvKsosQ1CPwDv3uFh+2

    Score
    1/10
    • Target

      libcurl.dll

    • Size

      449KB

    • MD5

      f17bbe4b592ef5e2e5563c90aa6e9477

    • SHA1

      836f12ca42b151eda66e542c8f81d965e377e7eb

    • SHA256

      77208031dc7fdae3fc6bd8e2dd7173b740ba8527aa37bfd1774fa16ce26f9290

    • SHA512

      5bbec8fe82bf7a9e719040064e1ad7940e44e81ffb5c7d9f4d320477e4a14050d632c8003a85b081d7923d90722b769c0bf0a602e191389eb1ae318b3a6da4fe

    • SSDEEP

      6144:EPTD6DxLdMoND2/RNMPs00bqRv/suZN/RgbyR/Z79TBtgNS:EPHWxzNi/UzfXBN5mk9TUS

    Score
    8/10
    • Downloads MZ/PE file

    • Target

      libssl-1_1-x64.dll

    • Size

      687KB

    • MD5

      70d81d5cdf48abebc6aedae38aec704a

    • SHA1

      9346878ae8a259192a65a750ac033819d7326501

    • SHA256

      49fe8b7f1580290335970b79d772f7fe91eaaa711068be86d7500213506afcd8

    • SHA512

      f5226795667cb6731bb3b47e8da5a1999201c0a4bbfc74652f2dabaa106702de9828f6a04d64e54742f21b2bd7564e6bd86dd9c7b12a2e2084e8c20e66a2b9dd

    • SSDEEP

      12288:wKaRK32Hgz6g1MI7t0pXDtfzeC83bZ0DoumKmqLh4YodAfvGw5U2lvztG:KH0MI7t8EuaO+dAfOEU2lvztG

    Score
    6/10
    • Downloads MZ/PE file

    • Target

      msvcp140.dll

    • Size

      603KB

    • MD5

      a1d30ef2114e18e26e2bb96555be81bf

    • SHA1

      a5e3e5a5910dd0781caf0a9f58dd7b519de8c927

    • SHA256

      f87819ae8c6f7c90d3237a1abb9809e8cba9dcd0c80ac3f0969a5e68ef652ca4

    • SHA512

      5c5bdae87327b3fb724844087257a0ba0e7ad31c194ab5f632845e8f09633f63982817ca551d1735523b1a65763efa3c2ddc8789b3bf23324d7882456e3aa6f2

    • SSDEEP

      12288:ttc7Tg4ObbZu3JZfzeUQEKZm+jWodEEVTMj:U7Tg4+Zu3jJQEKZm+jWodEEVMj

    Score
    8/10
    • Downloads MZ/PE file

    • Target

      msvcp140_1.dll

    • Size

      30KB

    • MD5

      a0b595f95be9cce12bff7ef199f874c4

    • SHA1

      7fc5f91033cd83f11ce03ab2478d9b29036e6535

    • SHA256

      b05f3dfd4e999c3e110219fb59151cbaa322757f4f3ce52b64dddc853e5c105c

    • SHA512

      182a0cc4227afb43228ebe5033977fcfb4c8ebb2f047d2decfab8f33453fd2262e62dd80b2b0f34cded9a8ee784d7449120a000aeb1949642bdf8cc563282b8e

    • SSDEEP

      384:6i/3lk2SyA04U9Kqnd5ZWcR5gW546QpBj0HRN73YxQHRN7MCMlvz:bObyl4+Kqd5DPXqW3Yx8A

    Score
    8/10
    • Downloads MZ/PE file

    • Target

      msvcp140_2.dll

    • Size

      198KB

    • MD5

      bbcf50b71928edb1c32c969d0533753c

    • SHA1

      faca1db3873d478b17fc6791b94fae651202627a

    • SHA256

      7d5d180c8e41b1964835b2550191e2d9054d8f4beff898ade67b3d5dd25b5101

    • SHA512

      e3890679d21e76a19361cc181eda9323ba31fb1211124e40fa3c9834cb0bfab6f7b3b34cf349ee4d7b3cc10e50813ae728dd01dd254eee098f3971f07679d710

    • SSDEEP

      3072:0m2dow+wS2vEYFBeoVM4ZaeEQDjQdA05+TiIfH+YKpHANGbaQLvaOvV:0xhbBFBnPZTL0mfiAN9Q7aOd

    Score
    8/10
    • Downloads MZ/PE file

    • Target

      msvcp140_codecvt_ids.dll

    • Size

      26KB

    • MD5

      e42f86965ceb093d95b9c93bd87b179d

    • SHA1

      4184b271261b3eb9c0193e5e6874b8847b18dc22

    • SHA256

      1e56cee876940affe9883aeccee9132280d03fd4282ab6552adf75fbeeed2bac

    • SHA512

      6b355d468fd8214cf50cef7d30a9098c812b60f0215726da937361e0cf2d2b8362ae5bc2b88c5e8dd48298c13b1be1a52d7f68d075c2a8d9c93480354b0e8420

    • SSDEEP

      384:OTDpEPOCAbHWi/EWz46QpBj0HRN7bX8QHRN7ep1x09lT9D:qNEFa1XqWbX88epQD

    Score
    8/10
    • Downloads MZ/PE file

    • Target

      root-service-provider.dll

    • Size

      590KB

    • MD5

      d991901b3fb8228b3637e4483cc36260

    • SHA1

      57e769738c10ca5aa43de3fa20883fc49acb9922

    • SHA256

      e06e2da83d8506522be3f269941408373c70d10a1cc6072a9110db9615ebb176

    • SHA512

      c9fafe1133fde3e4fc36e70b97ea152bf8728f6a1f1022be5f1f98ccb550c98e272f3510b7c18f6168119a9c45b1ce79920ae5d93261eb765f162dd483cae232

    • SSDEEP

      6144:DLfoRIJ9O2qXPKTG1KyK63fGMEfJ8MHPxpFjYU8a4Z/u/lWbTO+FIIZoMhNdLkLe:gmMEfJ8MHPxpFR8a4Ru/lWbTZF/ZoDNY

    • Detects Rhadamanthys payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Rhadamanthys family

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

    • Target

      settings/chrome_elf.dll

    • Size

      968KB

    • MD5

      ddc33cf2f8a0d4fa0b96667cb037a5bd

    • SHA1

      277e4695266d7ac368a7635476556a2cc4793d98

    • SHA256

      cdac4bac1481074e5a1664a2c6437273b0a2da068ede892ed0468825429e5e77

    • SHA512

      574bc9f683a8a18b34e70d6830dcc6c0e605f3ed601f921d525f712e74ed3c83e106eb43551ab3325566e032a98a752e24407494081863dd4bc5fcd20f079bd9

    • SSDEEP

      12288:kVq/yoDkMVSDPwy1wmThw2ljaR0E/uDmH5wvQwmeR5+n+orQ:dbsZwmTd1UuiZTwTz

    Score
    8/10
    • Downloads MZ/PE file

    • Target

      settings/d3dcompiler_47.dll

    • Size

      4.1MB

    • MD5

      5daacc29ed5218bcb836bfa8dba4dade

    • SHA1

      0f94d6b63e1a8c5def69377a9c2c5b9ed8a2a9d9

    • SHA256

      b548547f7f7e6afc5769be1f084b3e13b6bce07fbacf5de8156a5f88328b621d

    • SHA512

      8ad9243d7d811d8e9768d8213a0bf0c120b8b3081c8374de8459d56ec9e10f11f81acf0d4421d949d3a892bc9468559c4c148b548f1128b674990afb55a31347

    • SSDEEP

      49152:l5EfJYiVk9w6hAPqzag2At6i5K/8Ub6Lg3MEq/NHiQTtVr+5kb62QgdD6zoodr7z:j7iNPWHYE+Bnmc

    Score
    8/10
    • Downloads MZ/PE file

    • Target

      settings/libEGL.dll

    • Size

      382KB

    • MD5

      2bb37aae4eec265d97aea03800a26145

    • SHA1

      06542423b68110c3d5ecf2159114f4c0bc2879b9

    • SHA256

      4a34a80415a041caa00456fcbcfa24cbe8a05d699c8cc302215823826e94bc54

    • SHA512

      66d6307e2a412aadc731bbfe0d96cad3f0aace100de0f7cba970438f7cc8087b8c6a5ac205809622e58d46b92f43da7b213a4713885ae247a1a229e8abf4125a

    • SSDEEP

      6144:5fn91PNKeDQhPAybcKwtN0eHpN5uv4XdWT9V:5fn91PDDQhPRNkN5uv0W3

    Score
    8/10
    • Downloads MZ/PE file

    • Target

      vcruntime140.dll

    • Size

      87KB

    • MD5

      23105a395b807d9335219958b4d0cec1

    • SHA1

      fb60050d82e3bc1be3b10877b9355f5d48e04854

    • SHA256

      61832990e364dca5bfa2c61d930f00acaae6d1aaa3130392403455ae9a1125a5

    • SHA512

      ef91d19e632d0d146fa68d52beb04ffcb9b972079cd9c255f44ea5201637a8b00907ec8e3358c7b5cc37338470e29e43dbaec7ddc0562810b49ab2e8115cc805

    • SSDEEP

      1536:fTSVLL1/VfZPtsO6nBy0r8Z3j5X7K0d4HIH8d2//zoXnf7toecbNCOAS7Z:fW/tB8n8F4i/LoXfeecbNCA

    Score
    8/10
    • Downloads MZ/PE file

    • Target

      vcruntime140_1.dll

    • Size

      43KB

    • MD5

      9040ed0fdf4ce7558cbffb73d4c17761

    • SHA1

      669c8380959984cc62b05535c18836f815308362

    • SHA256

      6cc4315daceb0522816c60678344466cb452426267f70c7faae925361674e774

    • SHA512

      303143006c781260540e9d0d3739acc33f2d54f884358c7485599dd22b87cce9b81f68d6ad80f0f5bb1798ce54a79677152c1d3600e443e192aecd442ea0a2e4

    • SSDEEP

      768:vG3xRsJTKdiibUoT2zvivbXXyJWqWZ8DZX:vG7DyM22DiJMCtX

    Score
    8/10
    • Downloads MZ/PE file

    • Target

      vcruntime210.dll

    • Size

      27KB

    • MD5

      60e94c457312c39cebeaa44c365013ca

    • SHA1

      39e125e04dde3c9a20f5e6fcb0560897a0f4a6dd

    • SHA256

      638e5817aabcb9344e083b5c59cf73950cc0ec4440635e7f3ea6a65d7f25be47

    • SHA512

      250016ac13caca70c7fcd9991f7d7d46835038e4a62c277fc08d32310839e4af36cb3bad805b97573bffadfb7ddf3e8e452c7d6157ff98ea17a669349711a9a9

    • SSDEEP

      768:CTbEinVPfzZiCVJW19JDFGX3mFiWbBO8mC/DQU1:CTgEhNi4JWD7GX3mFy8mC/cK

    Score
    8/10
    • Downloads MZ/PE file

    • Target

      vcruntime211.dll

    • Size

      439KB

    • MD5

      fa47d70b3a979cb311ee7f1790ed9f46

    • SHA1

      27e7e114f3678311768269bb481adeea89a97c5e

    • SHA256

      e0d0945e5c34276578d651b0aaf4d2a40ba67d9c4af8773bdf99abeac60e5160

    • SHA512

      15f9a9f5315b06e57f6d00cbc467fc6a541599624e70d1d47c67318c89bd954d38e6fccbf94d2362a5b1272c2d5c5666a43392d3ec3ba6d5ae765a01253cb055

    • SSDEEP

      12288:XKV/4w+WDhYuwn72U6EVoabc06Yx2tnY4NG8t16PPQ+4b:a/JDhbiWMoabcJc2tY4x36wX

    Score
    8/10
    • Downloads MZ/PE file

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

rhadamanthysdiscoverystealer
Score
10/10

behavioral2

discoveryspywarestealer
Score
7/10

behavioral3

rhadamanthysdiscoverystealer
Score
10/10

behavioral4

rhadamanthysdiscoverystealer
Score
10/10

behavioral5

discovery
Score
8/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
6/10

behavioral9

Score
1/10

behavioral10

discovery
Score
8/10

behavioral11

discovery
Score
6/10

behavioral12

discovery
Score
8/10

behavioral13

discovery
Score
8/10

behavioral14

discovery
Score
8/10

behavioral15

discovery
Score
8/10

behavioral16

rhadamanthysdiscoverystealer
Score
10/10

behavioral17

discovery
Score
8/10

behavioral18

discovery
Score
8/10

behavioral19

discovery
Score
8/10

behavioral20

discovery
Score
8/10

behavioral21

discovery
Score
8/10

behavioral22

discovery
Score
8/10

behavioral23

discovery
Score
8/10