rhadamanthys

General

Target
Load.exe
Size 1.5MB
Sample250801-xfb3dser5w
SHA256 7d535ced79cd715cc19958b60bf36c8c1767512badbe52cd5de772794343f891
MD5 85a6255db6f91e55ae555765ddf6da3c
SHA1 d65b6d1bdc2d714ca42332f25e1016a9f51bd3d1
SHA512 2ed6ce51f0b28b83c008d7fe7d7335de00da946892d7b9ad8716f24058d193e718a80085794d6128fee827a9156307014c7adfbf1527034b757803ce24f23679
SSDEEP 49152:WeVM0iS5rPZhlDRGfyaH261Bx9Rd8FBWz3u:5M0iS5fv/aT/RufWru
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Load.exe
- Size 1.5MB
- SHA256 7d535ced79cd715cc19958b60bf36c8c1767512badbe52cd5de772794343f891
- MD5 85a6255db6f91e55ae555765ddf6da3c
- SHA1 d65b6d1bdc2d714ca42332f25e1016a9f51bd3d1
- SHA512 2ed6ce51f0b28b83c008d7fe7d7335de00da946892d7b9ad8716f24058d193e718a80085794d6128fee827a9156307014c7adfbf1527034b757803ce24f23679
- SSDEEP 49152:WeVM0iS5rPZhlDRGfyaH261Bx9Rd8FBWz3u:5M0iS5fv/aT/RufWru
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

rhadamanthys discovery stealer
- Detects Rhadamanthys Payload
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Rhadamanthys family
  rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Enumerates processes with tasklist
  discovery
behavioral1
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral2
- Target
  $TEMP/Pills.accde
- Size 26KB
- SHA256 4f01d72b47630324ba241daff69d1215883bea0fdc46ef711638e60ff0df8703
- MD5 9abf97936b0e4194aec3c472a6c0718b
- SHA1 d70271905125085140fce9c577adfaabfe79bc21
- SHA512 a61cfe75c888f9fc56ec2c6bdf779936e2d2e043c35649d3599c2cab4b6c6e5335835443712a28f1c7ba09f694780f1bd65f269cfbc51bebe56531a726b0b332
- SSDEEP 768:5rik9xetXUwmuX9rRo2AOgkK/954+G7KTAsc7:dzxo0q4/9gmTAsM
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3