Overview

overview

10

Static

static

5

Endorphin.exe

windows10-2004-x64

10

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$TEMP/Asin.jar

windows10-2004-x64

1

$TEMP/Busty.jar

windows10-2004-x64

1

$TEMP/Earning.jar

windows10-2004-x64

1

$TEMP/Forms.jar

windows10-2004-x64

1

$TEMP/Ink.jar

windows10-2004-x64

1

$TEMP/Inst...on.jar

windows10-2004-x64

1

$TEMP/Rachel.jar

windows10-2004-x64

1

$TEMP/Resolve.jar

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Endorphin.exe
  • Size 1.5MB
  • Sample250804-15twaabl9x
  • SHA256 c3b236af617c181af2fd23ffedbd6a62bf33b8978e17bc2f731686e938eb60d6
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
rhadamanthysdiscoverystealer

Malware Config

Targets

    • Target
      Endorphin.exe
    • Size 1.5MB
    • SHA256 c3b236af617c181af2fd23ffedbd6a62bf33b8978e17bc2f731686e938eb60d6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    rhadamanthysdiscoverystealer

    • Detects Rhadamanthys Payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Rhadamanthys family

      rhadamanthys

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates processes with tasklist

      discovery
    behavioral1
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral2
    • Target
      $TEMP/Asin.jar
    • Size 161KB
    • SHA256 85e1950ab4ff2fff8f7e6667ddbe6e3db0a5385a1a06d91f8d12adb7e7f32d29
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3
    • Target
      $TEMP/Busty.jar
    • Size 139KB
    • SHA256 c8dc2a03551e96253e5957153c37753a38bac525187e57cceeaf845bfadfe7f9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral4
    • Target
      $TEMP/Earning.jar
    • Size 7KB
    • SHA256 40c5e65afa71f3b3be71af3a619288e72ec1009976134f43c6ae9473e51a86ce
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5
    • Target
      $TEMP/Forms.jar
    • Size 109KB
    • SHA256 d23f6ca4eb1c74775092f5966180f7381a477218f914923502ecd711f1cf2ab9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral6
    • Target
      $TEMP/Ink.jar
    • Size 142KB
    • SHA256 bcf153d587ff68e585663bcd13a1558679c7280d4bf8ae06051864c4cbbc84db
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7
    • Target
      $TEMP/Instrumentation.jar
    • Size 150KB
    • SHA256 bc837e85ec45b83d8b36c2fbd5c53fc99ce28168dd2d7400f99101d7b8e58f2f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral8
    • Target
      $TEMP/Rachel.jar
    • Size 146KB
    • SHA256 03eb8b2c27435dff991f40357c9f160bfac6b7e49a232e93321c1823280a40df
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral9
    • Target
      $TEMP/Resolve.jar
    • Size 121KB
    • SHA256 4feddf1fb9c0bce929d8824aa4e20f7dd22c7026fe5f935838cafb94f036c17c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10

MITRE ATT&CK Enterprise v16

Tasks