Overview

overview

10

Static

static

1

YouTube Pa...y).msi

windows7-x64

10

YouTube Pa...y).msi

windows10-2004-x64

6

YouTube Pa...y).msi

windows10-ltsc 2021-x64

6

YouTube Pa...y).msi

windows11-21h2-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    YouTube Partner Program Policy Update (2025 February).zip

  • Size

    1.6MB

  • Sample

    250217-vxdw7s1kb1

  • MD5

    90aaa501726e8ee81181cbb2dadbebaa

  • SHA1

    950000484506985bbc5ffc60dfeb84cddf584722

  • SHA256

    62bd95eac144ded7c0aa3777f611939144652961b2c91a8a71376a6967439313

  • SHA512

    bee968ee6688088dcfc4d89265fb516b5316d512e01ab7cef9be06d177363e0b695b8b0698ff38e93a14765020f67375844f7f6749c3bec1ff7eba256f04552f

  • SSDEEP

    49152:L47koMCcu4pcM6YhV9DNxyEVODJ41VhAtroq:L47kor6v6CVBKxl41jAtrn

Score
10/10
rhadamanthysdiscoverystealer

Malware Config

Targets

    • Target

      YouTube Partner Program Policy Update (2025 February).msi

    • Size

      1.7MB

    • MD5

      651628d8ba1677cee19fe5014b0b6d64

    • SHA1

      7165bb6280cadbcfe48238d09e80db6a9da7e035

    • SHA256

      105cba529818d0fe22a17177a7fca1b07c75951ed9dd7676d1fc191703c62e7f

    • SHA512

      2390710547cc82623d792b61522cd87091ae9b683b747ebb6053a0e385d08abcff9c47c8992b71270abcde70957d7364f28dc06cf371559b8b2177872de564c6

    • SSDEEP

      49152:Tc1agkIumpuu4aFl9LNJymz4DBiFVhYZt:Tc1agSMr4olVO5ViFjYZt

    Score
    10/10
    rhadamanthysdiscoverystealer

    • Detects Rhadamanthys payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Rhadamanthys family

      rhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks