General
- Target 0015157c5bd151f1b5a81a07ccc54b51bf99931155c1f60cf2abaee151495a57.exe
- Size 95.0MB
- Sample260602-1h36faet2x
- SHA256 0015157c5bd151f1b5a81a07ccc54b51bf99931155c1f60cf2abaee151495a57
- MD5 812ebc9897be48f84d2d287bdcb5410e
- SHA1 dca86fcfa131a824ae0e85bbad38567c2b5b3feb
- SHA512 4c1b721b2f6bce6bad2493b89f780c4ff4150c7d1ac676743f7b81689189dd913802afd07c6e15cfa26e958eb749a6ab29b6144ec6a93ad68dca859bd44379ea
- SSDEEP 24576:1YnNzTxjlLzvFXp5ULpm9CsoQ3lMhCwTlRM5SGeII4HjjcNml59qUEkRtuUPzY/X:+bjdpXIKQQURMc4DjlliUtRtuUE
- TLSH T1CB282B32A15CF76E3A2275E7F5B1AF00622AE86CF157C73EB702214C9B6D05790653CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
0015157c5bd151f1b5a81a07ccc54b51bf99931155c1f60cf2abaee151495a57.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
0015157c5bd151f1b5a81a07ccc54b51bf99931155c1f60cf2abaee151495a57.exe
Resource
win11-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260513-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 0015157c5bd151f1b5a81a07ccc54b51bf99931155c1f60cf2abaee151495a57.exe
- Size 95.0MB
- SHA256 0015157c5bd151f1b5a81a07ccc54b51bf99931155c1f60cf2abaee151495a57
- MD5 812ebc9897be48f84d2d287bdcb5410e
- SHA1 dca86fcfa131a824ae0e85bbad38567c2b5b3feb
- SHA512 4c1b721b2f6bce6bad2493b89f780c4ff4150c7d1ac676743f7b81689189dd913802afd07c6e15cfa26e958eb749a6ab29b6144ec6a93ad68dca859bd44379ea
- SSDEEP 24576:1YnNzTxjlLzvFXp5ULpm9CsoQ3lMhCwTlRM5SGeII4HjjcNml59qUEkRtuUPzY/X:+bjdpXIKQQURMc4DjlliUtRtuUE
- TLSH T1CB282B32A15CF76E3A2275E7F5B1AF00622AE86CF157C73EB702214C9B6D05790653CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects Rhadamanthys Payload
-
Family: Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates processes with tasklist
-
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- TLSH T116C1F7B656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AA6FD68751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10