rhadamanthys

General

Target

EchonexMeets.exe
Size

5.2MB
Sample

250222-qjvkksymz7
MD5

521706693511fdecdb0d9052a50ae5fc
SHA1

94214094c8c7c16fb4afc0947a47a386366f4e81
SHA256

b1fa0c62e07f9ad0a625fd1474a197c1d687b985714c3d697981f5fbe4993266
SHA512

ea9608a78e1363b73174c2a3a0732e98fca9e358949e64bfdd7d4dcd9c0a6ccdc2214033dc59cb2c658cc364c172e791233654b3ecf6a1e0cf351b16749f9b74
SSDEEP

98304:PE+JqHlyDS/KzOYH8t9WB2XPzvSXIXf/a+dab7jgOnXTzKqCUvsARxefha5:PE+JqHlyDSixHM9WB4zEHhnXTetUTeC

Score

10^/10

Malware Config

Targets

- Target
  
  EchonexMeets.exe
- Size
  
  5.2MB
- MD5
  
  521706693511fdecdb0d9052a50ae5fc
- SHA1
  
  94214094c8c7c16fb4afc0947a47a386366f4e81
- SHA256
  
  b1fa0c62e07f9ad0a625fd1474a197c1d687b985714c3d697981f5fbe4993266
- SHA512
  
  ea9608a78e1363b73174c2a3a0732e98fca9e358949e64bfdd7d4dcd9c0a6ccdc2214033dc59cb2c658cc364c172e791233654b3ecf6a1e0cf351b16749f9b74
- SSDEEP
  
  98304:PE+JqHlyDS/KzOYH8t9WB2XPzvSXIXf/a+dab7jgOnXTzKqCUvsARxefha5:PE+JqHlyDSixHM9WB4zEHhnXTetUTeC
Score

10^/10

discovery execution rhadamanthys credential_access persistence spyware stealer
- Detects Rhadamanthys payload
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Rhadamanthys family
  rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2