diamondfox | 8996b6b960fc7d2c667c22cb0f07e8c1def8e5570293fbcb6687bc7da10d4423

Sharing

Copy URL Twitter E-mail

General

Target
Creative.Launcher.2025.rar
Size 762.2MB
Sample250810-vmljassxd1
SHA256 8996b6b960fc7d2c667c22cb0f07e8c1def8e5570293fbcb6687bc7da10d4423
MD5 2bca8c7d523f8ebcad0bd4ef9082c467
SHA1 84babd0b1e7cfbcfed7c7309e039e057d252ee14
SHA512 649c04150327b3bdb7d550f84804dcc4a3f3bb0eeab1ebf53b6484ba0b0dc995c915f6c71d8b13bdf5d09653ae12479a1567588d23d37ef556a975ee2a074593
SSDEEP 12582912:EMnCcOlyD/mI57NKQdLwRYvZm6KmcLjsUMzzKI9cnVBTFzcrcUdWfjx/OZU1Ue7p:it4dLwyv7KmcLjhMzz7cDTFzcAUkfVMy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  Key-File/FXSCOMPOSE.dll
- Size 457KB
- SHA256 d9d557df57b0d4a080dee2656a3a391d19580b2def22b923eb3256373f97fd4b
- MD5 b0e7eb9d3480d7ac2236610d8f31141d
- SHA1 05df6ae3fbe9c76470618b35eeb5b4f3c6c00b2a
- SHA512 24950271b329f0302203a834de57c1a2bf748b687c7472e73b28471ddd91cebd2cb0e17cc5ae12fd15efe3f7a63f4d9befb3fa08fe3502b99f1b20183dac6ea8
- SSDEEP 12288:uiij7QkXw/yFAbsUkohZGmWIdrVL4g7PRWo:2wQobTPPRW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1
- Target
  Key-File/FXSCOMPOSERES.dll
- Size 34KB
- SHA256 88ffab9b4c84d60b2a9b8a1c875fd53fb3fa6846f9f9887d1392781a3aeb86c0
- MD5 fa1c894e6784410018209c7cf5804822
- SHA1 33b792b17ffbb5988cd26bfd96da902ad4ea1083
- SHA512 00a9e77c0ee06f35bb081cd2f6a7d26a3c0721abc72d02f1ae70880b640dd94cf19bd8d38ecc4b121e0b64ff0210aeffc4073da334813e9339f96dcde6689f35
- SSDEEP 384:KWBgWiV7n8tD778HdyGLIeB7nov8uEYypeKK8Nufb9+Zq+QqL8jt8j08jT:9SnGgbFov8uEYypeKK8Nuf8AWd
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  Key-File/FXSUTILITY.dll
- Size 182KB
- SHA256 8d1b02261040f4a180bbd3cb32a13fa84cc94af53d9660e9548b9e04ec630927
- MD5 ece957d3c45fbe1140e54cd7686b4039
- SHA1 d9511e734e1ed0b27c649b76c96e2fc2019ed196
- SHA512 020c310763a8a555c34746926ffccca4ebc3cc268957f08d67b1049d4c49df0ce2bc5aa7487d96f777bf36ef5327348459aa89612cd1565599c47f760168ef50
- SSDEEP 3072:rFYrFsH6llFKJz/5M63cXzQNA455i4FMtRHE3VQlOeNHZko:rYFxlF2z/5M63cXzAx52RH2aOeNHC
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3
- Target
  Key-File/WFSR.dll
- Size 654KB
- SHA256 9213bf2d8bc74c7d7a8e61306cfe584ba08e716f7b67eb9ba6265d976021564c
- MD5 afc716cc815b5cdb2b971ecaca199ae6
- SHA1 c09291fcb8a8cc82b56d41644e4d088eefb0d7d7
- SHA512 1db88f881805214a2a868cd09949b7c0e804b0df69c642643199817da1eb7b1b908c68542077c5bff9264bb973821b87fa0fecd18b301ea2edf120d5d501e23c
- SSDEEP 6144:tUcSbcY+CaQdaFOY4iGFYtRdzQ5CGrNQcSbcY+CaQdaFOY4iGFYtRdz8f5Zrfu:tO+xt4vFeQPrNS+xt4vFe8f5Zrm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4
- Target
  Key-File/Win32_EncryptableVolume.dll
- Size 245KB
- SHA256 5ca212d1f4bb9ef16c1a5286a7fd3706cfb13b3e9d900517e4c2532f6650a775
- MD5 28e2a0e0185e5bf6338ad24fff0b1ccc
- SHA1 453ea8a2ee33d8c83185cae8eca761f788cf1222
- SHA512 c345483a164af30485a2cdc1fb01a9d0b9316d96f670e30b1a38dbc14f6330bd65832977c727614614e60f2afd37b3fb4df4816578b37317b82db3ecbcdc893f
- SSDEEP 6144:Gq18lAdEON68IDC+EpEIB3ULNb8EmzVDw44m+u:GqfdEO9+EpEIB3Qmh
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  Key-File/fveapi.dll
- Size 968KB
- SHA256 505178e5139cafd4b8a323113fae1c1bb0ccc5c25c64ccd4ae80251da77c219a
- MD5 b09c73687420209b1c11002bd24d16a2
- SHA1 cde4f4e0e37591c3a71ca3841c492e712d2f2c80
- SHA512 9bd6735a0ea1530be96f1147949c724e0c8eb70082340d70c1236cf3f87d02d911f6cec8ed890cea054f12a59e492074667ea2ecb3596dcc7103c70c22d1307a
- SSDEEP 24576:1NghOQbfeoHBZeZBWWQ+bs25BBR1d4q3usBloA/t:TOOQbGw2KB+o2r+sBloA
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  Key-File/wmp.dll
- Size 10.9MB
- SHA256 523e1932d0e88350c8e9193c0ba957dc4c2b4b36392bd771ecc025907bc69895
- MD5 d5a113a27deb58849525b9c2f782ca3f
- SHA1 4516469fa9bd8a75743d692fbe3eec3cde51a044
- SHA512 ca151cf89839c21584ff4629071be37657688c1c9843136f0719499d8f0b4851ed861edc412410873ba78f81ebe5df0218beae90c62e8ec281487804b5a61b3d
- SSDEEP 98304:NDlAMJo6g+VtdpkNonr5BHPtie96c4TSSlFXpyjCrhepRQ8P:Xo6g+VPpgm9BvtJ6JTSSDELJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  License-Terms-Global/Global-Term.dll
- Size 4.8MB
- SHA256 a72d12498d3781e68fa1629d07ec731e7125427754d6116ef5176c12acd255e5
- MD5 df0983878b86a53900790b2653c2fe87
- SHA1 97c6bdcc0be165d91f0cecedaf8fc55e1a78793e
- SHA512 497e32b728b8aefa07a0fdf2e94f5b77a68791c0b5ef29332bdf4e5b01826d447083c87f9798ae8ac7150cc26622c0e3b4aee3a66b54e1ce20e92417c40c3dfb
- SSDEEP 49152:+qDQuuSO1ue9Qq54G7j3RJjzuvPlOjG/nJ4nYewE1cOQ02GLzEz1vI5darIT45Ze:pyu784G1E59S/EC/TMmcT7eh/GXJd4
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral8
- Target
  Local/FXSCOMPOSE.dll
- Size 457KB
- SHA256 d9d557df57b0d4a080dee2656a3a391d19580b2def22b923eb3256373f97fd4b
- MD5 b0e7eb9d3480d7ac2236610d8f31141d
- SHA1 05df6ae3fbe9c76470618b35eeb5b4f3c6c00b2a
- SHA512 24950271b329f0302203a834de57c1a2bf748b687c7472e73b28471ddd91cebd2cb0e17cc5ae12fd15efe3f7a63f4d9befb3fa08fe3502b99f1b20183dac6ea8
- SSDEEP 12288:uiij7QkXw/yFAbsUkohZGmWIdrVL4g7PRWo:2wQobTPPRW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  Local/FXSCOMPOSERES.dll
- Size 34KB
- SHA256 88ffab9b4c84d60b2a9b8a1c875fd53fb3fa6846f9f9887d1392781a3aeb86c0
- MD5 fa1c894e6784410018209c7cf5804822
- SHA1 33b792b17ffbb5988cd26bfd96da902ad4ea1083
- SHA512 00a9e77c0ee06f35bb081cd2f6a7d26a3c0721abc72d02f1ae70880b640dd94cf19bd8d38ecc4b121e0b64ff0210aeffc4073da334813e9339f96dcde6689f35
- SSDEEP 384:KWBgWiV7n8tD778HdyGLIeB7nov8uEYypeKK8Nufb9+Zq+QqL8jt8j08jT:9SnGgbFov8uEYypeKK8Nuf8AWd
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  Local/FXSUTILITY.dll
- Size 182KB
- SHA256 8d1b02261040f4a180bbd3cb32a13fa84cc94af53d9660e9548b9e04ec630927
- MD5 ece957d3c45fbe1140e54cd7686b4039
- SHA1 d9511e734e1ed0b27c649b76c96e2fc2019ed196
- SHA512 020c310763a8a555c34746926ffccca4ebc3cc268957f08d67b1049d4c49df0ce2bc5aa7487d96f777bf36ef5327348459aa89612cd1565599c47f760168ef50
- SSDEEP 3072:rFYrFsH6llFKJz/5M63cXzQNA455i4FMtRHE3VQlOeNHZko:rYFxlF2z/5M63cXzAx52RH2aOeNHC
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral11
- Target
  Local/WFSR.dll
- Size 654KB
- SHA256 9213bf2d8bc74c7d7a8e61306cfe584ba08e716f7b67eb9ba6265d976021564c
- MD5 afc716cc815b5cdb2b971ecaca199ae6
- SHA1 c09291fcb8a8cc82b56d41644e4d088eefb0d7d7
- SHA512 1db88f881805214a2a868cd09949b7c0e804b0df69c642643199817da1eb7b1b908c68542077c5bff9264bb973821b87fa0fecd18b301ea2edf120d5d501e23c
- SSDEEP 6144:tUcSbcY+CaQdaFOY4iGFYtRdzQ5CGrNQcSbcY+CaQdaFOY4iGFYtRdz8f5Zrfu:tO+xt4vFeQPrNS+xt4vFe8f5Zrm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  Local/Win32_EncryptableVolume.dll
- Size 245KB
- SHA256 5ca212d1f4bb9ef16c1a5286a7fd3706cfb13b3e9d900517e4c2532f6650a775
- MD5 28e2a0e0185e5bf6338ad24fff0b1ccc
- SHA1 453ea8a2ee33d8c83185cae8eca761f788cf1222
- SHA512 c345483a164af30485a2cdc1fb01a9d0b9316d96f670e30b1a38dbc14f6330bd65832977c727614614e60f2afd37b3fb4df4816578b37317b82db3ecbcdc893f
- SSDEEP 6144:Gq18lAdEON68IDC+EpEIB3ULNb8EmzVDw44m+u:GqfdEO9+EpEIB3Qmh
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  Local/fveapi.dll
- Size 968KB
- SHA256 505178e5139cafd4b8a323113fae1c1bb0ccc5c25c64ccd4ae80251da77c219a
- MD5 b09c73687420209b1c11002bd24d16a2
- SHA1 cde4f4e0e37591c3a71ca3841c492e712d2f2c80
- SHA512 9bd6735a0ea1530be96f1147949c724e0c8eb70082340d70c1236cf3f87d02d911f6cec8ed890cea054f12a59e492074667ea2ecb3596dcc7103c70c22d1307a
- SSDEEP 24576:1NghOQbfeoHBZeZBWWQ+bs25BBR1d4q3usBloA/t:TOOQbGw2KB+o2r+sBloA
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14
- Target
  Local/wmp.dll
- Size 10.9MB
- SHA256 523e1932d0e88350c8e9193c0ba957dc4c2b4b36392bd771ecc025907bc69895
- MD5 d5a113a27deb58849525b9c2f782ca3f
- SHA1 4516469fa9bd8a75743d692fbe3eec3cde51a044
- SHA512 ca151cf89839c21584ff4629071be37657688c1c9843136f0719499d8f0b4851ed861edc412410873ba78f81ebe5df0218beae90c62e8ec281487804b5a61b3d
- SSDEEP 98304:NDlAMJo6g+VtdpkNonr5BHPtie96c4TSSlFXpyjCrhepRQ8P:Xo6g+VPpgm9BvtJ6JTSSDELJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  Set-up17.1.exe
- Size 900.7MB
- SHA256 92b51c6c81203df4d98dba59898b98029587bb65e998299b8c120f2bb72d1768
- MD5 518685a116a96457e923ec190728a268
- SHA1 58c4750a270de100155b326f4ff5d30294bf29e4
- SHA512 7c240518fc136f3295803e0b45dc006eecafdf029e20bbcb9d652d98acd49a032fff09c793d43eca36e9892860887d80145a4e8920020e7660b5e1ced008a35a
- SSDEEP 12582912:Rp7LDpRd3TM5cZRNFUindNTFtZMBOCF+9jaMAYVQcN6JzN:RhpL3wqvNCinzTFtZii2MAQ4
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

rhadamanthys discovery stealer
- Detects Rhadamanthys Payload
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Rhadamanthys family
  rhadamanthys
behavioral16 behavioral17
- Target
  Updater.dll
- Size 4.8MB
- SHA256 a72d12498d3781e68fa1629d07ec731e7125427754d6116ef5176c12acd255e5
- MD5 df0983878b86a53900790b2653c2fe87
- SHA1 97c6bdcc0be165d91f0cecedaf8fc55e1a78793e
- SHA512 497e32b728b8aefa07a0fdf2e94f5b77a68791c0b5ef29332bdf4e5b01826d447083c87f9798ae8ac7150cc26622c0e3b4aee3a66b54e1ce20e92417c40c3dfb
- SSDEEP 49152:+qDQuuSO1ue9Qq54G7j3RJjzuvPlOjG/nJ4nYewE1cOQ02GLzEz1vI5darIT45Ze:pyu784G1E59S/EC/TMmcT7eh/GXJd4
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Detects Rhadamanthys Payload

Rhadamanthys

Rhadamanthys family

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18