Overview

overview

10

Static

static

3

goodboy.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    goodboy.exe

  • Size

    860KB

  • Sample

    250221-w8fqlsxkas

  • MD5

    11ad0f71caabbadba8ca08663690ca39

  • SHA1

    2dde6d4b02f8121c7e79af49ff524b96e62fc708

  • SHA256

    861f2c5f07c9e1c7d24c2e34eb47ff3129cd39a2227a2549809b9d5c92267883

  • SHA512

    ea4e66ea0df09c2f4ae90731ccf06343b7ba3066915f234858fdaee39cb39dc681ebcc9b82ccc38ab146330b1fad2cced798d0bf694ec9d31d963abf789c7a9c

  • SSDEEP

    24576:I2yEGU/CgPh3wl0oKEJKpSL3MG6/2ZbNy0:IFG/Cy5poKVpSTn

Score
10/10
rhadamanthysdiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      goodboy.exe

    • Size

      860KB

    • MD5

      11ad0f71caabbadba8ca08663690ca39

    • SHA1

      2dde6d4b02f8121c7e79af49ff524b96e62fc708

    • SHA256

      861f2c5f07c9e1c7d24c2e34eb47ff3129cd39a2227a2549809b9d5c92267883

    • SHA512

      ea4e66ea0df09c2f4ae90731ccf06343b7ba3066915f234858fdaee39cb39dc681ebcc9b82ccc38ab146330b1fad2cced798d0bf694ec9d31d963abf789c7a9c

    • SSDEEP

      24576:I2yEGU/CgPh3wl0oKEJKpSL3MG6/2ZbNy0:IFG/Cy5poKVpSTn

    Score
    10/10
    rhadamanthysdiscoverypersistencespywarestealer

    • Detects Rhadamanthys payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Rhadamanthys family

      rhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks