rhadamanthys | 16637168f9d85bb5abe9dbcd2586ee859fd2981e7ea173c031e0cf3bf0ee4da8

Sharing

Copy URL Twitter E-mail

General

Target
setup.exe
Size 90.0MB
Sample260808-a2na8azsbt
SHA256 16637168f9d85bb5abe9dbcd2586ee859fd2981e7ea173c031e0cf3bf0ee4da8
MD5 a4a52244c3f8b83b049ad426cf41b1ef
SHA1 7c205b888de4da3cbda69fd6ed99c5973de98e41
SHA512 3b0148bdd68ea7d8386d5b1a011a47413e2323027ea71f43bd12672f25f975056ebe06a6235b385fcf85067ff5b11f0dbcb85d1f324f50faafb27750aa8edfcd
SSDEEP 24576:VbB07bbr9qsQ7N7LaRmWs0/SoCzeWikqPuHTt++pv0bQ1PzGYSYHXKK19FiO:E7bsv7V63sAyzSjPm++pcb0PzGR471B
TLSH
T16A282BB91615B64EC2DE49B4B3B1498C26172FBF60204FD7E606E056B3EF4087F6A931
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  setup.exe
- Size 90.0MB
- SHA256 16637168f9d85bb5abe9dbcd2586ee859fd2981e7ea173c031e0cf3bf0ee4da8
- MD5 a4a52244c3f8b83b049ad426cf41b1ef
- SHA1 7c205b888de4da3cbda69fd6ed99c5973de98e41
- SHA512 3b0148bdd68ea7d8386d5b1a011a47413e2323027ea71f43bd12672f25f975056ebe06a6235b385fcf85067ff5b11f0dbcb85d1f324f50faafb27750aa8edfcd
- SSDEEP 24576:VbB07bbr9qsQ7N7LaRmWs0/SoCzeWikqPuHTt++pv0bQ1PzGYSYHXKK19FiO:E7bsv7V63sAyzSjPm++pcb0PzGR471B
- TLSH
  T16A282BB91615B64EC2DE49B4B3B1498C26172FBF60204FD7E606E056B3EF4087F6A931
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution rhadamanthys stealer
- Detects Rhadamanthys Payload
- Family: Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
- MD5 08e9796ca20c5fc5076e3ac05fb5709a
- SHA1 07971d52dcbaa1054060073571ced046347177f7
- SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
- SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
- TLSH
  T116C1F7B656C005F3E40D04B93E31280F87FEE426073242769E9B1ECA19D2AA6FD68751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $TEMP/Cab.png
- Size 272KB
- SHA256 ab24ed0b8b5b386fa2df64f97f6d7122c085097aaf1e28c2aee1cf3b4f0d2b9b
- MD5 bb422058e733342662d85572ef7aee17
- SHA1 f92958fef8442193d9f8a98b26b95f13ef82d8c1
- SHA512 2c1bea214bad38bd580ef025308e8c17980453f04624431550b02fa29d2701f74ab164ed3c3863c546f4bfc5eea705e5bb6afa494f6867496006c94e2813eef7
- SSDEEP 6144:2/PCFuGrCopU73WiDFiXBAG/jofMcPiLqK:2/grCnWiDhG/k1Ps
- TLSH
  T1C6442225EDC5BB51D370234D208B8BDA04636F6395AAAF5BE307877E473D8281EEE411
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  $TEMP/Porsche.png
- Size 207KB
- SHA256 7af66dcfc0d038a6fbb1516fa4a0378d6c99bf694f5fb610e78a9e9a0a2a9c9e
- MD5 5f6c0ed4251e34b66366ecd37fcb4488
- SHA1 71d1bdb81eb533b1258d8c7a1b6268418f47ef2d
- SHA512 cb78a64c0c97b54fc4c232c06f96b82e524bc14b67bd1b0b8699f41dad1a0520cd7f78dd6863cc2474831d94c2aa8daf22b0b291968b6d86714fe2fc25e75de6
- SSDEEP 6144:jGtoT5sAdJpSgY6dViIOWK4lHi2dJHzZf:qtoT5tpYciTgzJN
- TLSH
  T150242306AE64DA8B001CEE7EE551B0B0EBB843BB7E3CBA22D765B4023555413DFD0967
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  $TEMP/Rebate.png
- Size 14KB
- SHA256 1f7fbe3e9c082200a41676dc512501f51115ac0848f3b1a4f9e64bb98fe38da3
- MD5 a88d798563dc65614d10a0bdef2797c2
- SHA1 a7acfcb6e9e43fc3b04491508502abfc60737b19
- SHA512 e80d6df5b1074ea88492078ac79bd6bdf9340eabac1edb950a0c27565ccfe3f36080b5e7f6a14feeb76f2930ef84d98eb1d7cc74d984b8468f9b92f704c1afbf
- SSDEEP 384:x0f9mU9W5egpGK7FgbOncprEFQTdUPrQkg:ef9LEogpGKBgqncpgFQTwMR
- TLSH
  T175623BF4D2DA2103A78BF6A37B9649CEF872C30D1C16509C9EFE2A89D549CA41335937
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  $TEMP/Recorded.png
- Size 130KB
- SHA256 5a4f153424af06f2f9a6cef7f870c101675aae1e149cef20990302b705bf01d2
- MD5 35d90c004c0703c9df9bc9b747d5f517
- SHA1 ff2d57d26b01173076e6964310116cc607633b4a
- SHA512 b6e5f8d832e995a22bc8106b205ba2c039ed31c249495a47cb01cd8b0517476d6fd547b47b2719c5865e9aa975ff374b61be5653eef9884da5185cad7c824666
- SSDEEP 3072:SxaMNDe+HCoklH9fj/3KuLB+zPGMZOQNqkME96eFt:yagrHlsHljSS4zPGVQ0K3
- TLSH
  T1B3D312FA347B06654A99C3A287F374854D2BD8E1ABED760627AB01639B893C857017F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  $TEMP/Routine.png
- Size 99KB
- SHA256 dd2fb4c019966dc69c4088e412b841cd06fd2d2bfba765fef4da822be2dc0d3c
- MD5 6e6d0251fb155ecf036ff79f3beae9df
- SHA1 0d1aac8697937f95bff58ad36dcf4318ab9a5fb3
- SHA512 b2b7598ab90783569f64ecddeae974c4c8d52c9109a0ab7a36e7a09a63945c63221be2cb3d8c89a07c8616f6119b522c3538557f93e5314a7b41cc7588cafa17
- SSDEEP 1536:QRc7HKk2Gi43GTmIK/hgoBE0My1t+nIRJ8VJxAUcBTET4ceHtbzsJALXRW+V4ePp:QgHcGibmLhs0M4RMAUCC4ftPhLTuS
- TLSH
  T1B4A31267658E94833B159361BE8D112A5806005F4FDBB279ECD4880ABE1B74D2BF2CED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  $TEMP/Surgeons.png
- Size 493KB
- SHA256 19f513ab375e7d374ac1bff5a51fd417f23ffabf2508da6531b008c49bcad81a
- MD5 2194c7ca2274b7150db2064f096520a6
- SHA1 0a7bb4baa914a3a485bc6984b942431ff3f907cc
- SHA512 72eca6f7495bdbafb5f926d491ae69221f5229c553cc8245ab3be54aaf158c2684c040115cb82f7c3ad9887168698fcd8eac197308b96c1a5172023b26b5d866
- SSDEEP 12288:xoZGa6Q99RFCDjbnbrAetkqTeh7l3jTTtcQm8rRmaSFnJL:y33RwHbbrKqm7N72aRmaUh
- TLSH
  T1D8B423AE8CD5B6E56E837D7D88B962CC5D9096715CB4080A2F7B188ED10FE830A1D377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Captured
- Size 107KB
- SHA256 93bbe9cd906fedf288d4a0f69b96c397e76df055607f274b42453a2ee28b4e12
- MD5 41391584847bfb0a172ef243351db63d
- SHA1 3170637257245708c6e7197fd026f8fee7de5b38
- SHA512 38a8d56545973fe7b82cf4b3737dd393b1ec8d9f2ad72af6307041bdf219469d3b5cb0cd674726e54acac4df9325d3010c80932b1b4a3a1d08196c0f9bc1c3fc
- SSDEEP 1536:mdXibOT0EdQGQ9EtSijtNOKc+48918JsdVCsESNvmtpAi6JvAeInT3VCz:eXib+tSijpcVMFXD5ypAXoegzC
- TLSH
  T120B39E13A943006BCB6312705D0FBA36B7FEDE2B0138E59647C90869F7E2495A51F2B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  Cm
- Size 148KB
- SHA256 0150b6bdbb90600639e49e8075f328b9e0212089b7201e51a97060608b60b10f
- MD5 8fcecf61078fd0cd3231e4b9d8bdbfca
- SHA1 1499faf5fb1e17718869c05a7a3a60f10198da0f
- SHA512 a0c4b9bb35fd1574dfffefd010563b335ac059970c272dd4bef82f99483cb80b1a8e3bbd893c8428f93e82e9a9a232693d0c352d228c4dc1b9537f24d8a410e4
- SSDEEP 1536:fMBNIWPuwaAwu+1PdJaGloaj6bs8jcd/TcI3s+uXkrfhrRj3:EBN3vaAt+1Pfam6OzmkrJrRj
- TLSH
  T194E3820473B4C52AFFC7E67B5792C2064BFA7A9E8543412F20646BBAB8703B1077D961
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  Cross
- Size 148KB
- SHA256 7a25838b73012a6d4db5b3f54722e09edc590f93254b62c915e5936fa2881ea9
- MD5 be4194dc14f2af6deaee908e3bd777f4
- SHA1 7b35ebefcc3cdea9801cd547f72b2416d4da45a1
- SHA512 688aef8d9eda8468bff6915ba2b1e774b2ff9969359af24171db99e7c39240f9dfbde30a64e045dc2b92e114a9deac089f2d94a11684e7e31b63c15d1952e057
- SSDEEP 3072:LnasL9jC0O2iSW4QlXUxPrCtTRVB4Y3I09JwCIj4BPb1XuE/gc0Ag0Fuz08X8:vx1WUyB4Y3IW5Iuh0AOz048
- TLSH
  T1B7E36C1376E320E7CD7373F08F99EA69E776B91941318A3F03EC186AAF815029E55172
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11
- Target
  Orchestra
- Size 2KB
- SHA256 5683e251157d00d11325e85c9c2f7e6ef1b54b6b9d87731ec652985b938dc16c
- MD5 4659443a0740a8a32996574ff6b4fbd9
- SHA1 bf808cac4d86ad622921a0799e86cf0852fd87ee
- SHA512 30cedf385d88bae110a79b02fee300d507ebe574bf089443fe5c7837eab9147203d447eee58d9d8d20af7aeb41dde163b028f2ece860bb3db525b7adced5c32b
- TLSH
  T1E0417623FF7D45A4F4B60139F88E4715D16A0476C32352C70FC9263766C5439A7494C9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral12
- Target
  Product
- Size 104KB
- SHA256 f30695c3d6ac71d0cbaf7501efeabc9850260703c96463e72831537a3acb7d8a
- MD5 b2bde3aeceb2b098e012a5c7dd0e90ac
- SHA1 694198bdf50e7f9310f0306c0b25054b26c20194
- SHA512 26270e5cd9b60e84b17a596f78f2ba42d75f59eab015e6c54e3cfa3b0afa1a54104bb1d65ba48d19c527c208392b2005cc7bd49ece43b49818738b703adb5bff
- SSDEEP 1536:ih63EYrDWyu0uZo2+9Br+DATG62rt4dP+iX7DjfvSSuyxiQ:ih6DWy4ZNor+D62rqd2iXbvSS7iQ
- TLSH
  T195B38F535AA50557E4A77A38746FF73F0A68BD9F9B34B23A031C3FCA98206509894733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  Prompt
- Size 123KB
- SHA256 8e1790435e4e3e190c99be5bf58237c7e686c37ff70b3ce5a6c66b41a4ec5acb
- MD5 3b9e5a30697b19a5ee2c61e2305eeb6a
- SHA1 57d2fca86633417a5a252e3af6f374fcbdb01310
- SHA512 41e9c5a62191dae351eedaa2a2d6f11e5a7dd05c3a1c5d47058e0553deeab762d3daf921b29e99ae7c265daf17a9942b5ddad62fe38e58759000b179b0d58241
- SSDEEP 3072:xxRuNkdKF0vYNyet+JQ+HcnkL8xCSVYvlhx6vA3MD8jjg:xXuN2KFIyt+8ZUlhxb8As
- TLSH
  T1EBC39E127CC14031C95724708DBAA7BA9B3DA5601F28BEDF47991DB3CF206C09B6676E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14
- Target
  Publish
- Size 129KB
- SHA256 6822bf2bd1f6d9fe20ce90efa4f77ce292bc20f32d042606ba0ddfa7c75933e2
- MD5 11572607a9c18be790a1764cc11939ef
- SHA1 25f76dd00b4de7a61b8faad5d76854e66a326f91
- SHA512 f7d533837c6dd1d6910a197ef3d58af0592f8995aabcfa147d8016a1ec2264678d7426289da940021f5ca1837860dd83c02621ea99a89255c830d89e895345ed
- SSDEEP 1536:KHcUoNghHeqSkV4T2ubSWJKWNJELHW/EJlrZlYR+68cNk3smxUsb1yAwsc8MxqVZ:K8lghHzJi2ubSW4wC2mYR+HUDXOXT/Cm
- TLSH
  T16AD37D23B0C261A5C8D749F12D1BEBE27D78C93501349CC756D97DB9EA604A1AB2F3C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15
- Target
  Street
- Size 125KB
- SHA256 4b06936b8a536e549a14c2b94527cbc828b9799c061f035a9f3ace25b8622695
- MD5 6ff504390f2784c736d1cb86205329b2
- SHA1 44df337b7b10382bbc5ef77dcb276db17a588766
- SHA512 2fcc15308854ffabcf57ea29078ba4504c6febe54caa0a252e6153cc2e7e419c0fde8418275a984249171d6f97dfad46167759145f2dc24f513de21e708063b1
- SSDEEP 1536:T0YwYwTkNJ3Rpref3ghV1SKOxqNdunCMfpfpJKgMPdkdux84SbL8R571Nf0xe5cl:geVzOqD1IGuTpMgKYbwR5Exe2/RTX/4g
- TLSH
  T1EDC3AE4194B0C2A1C6561D305C95FF52ACBC8DBA032A9ADFF7D80D63AE20DEB9D24D53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral16
- Target
  Wallpapers
- Size 70KB
- SHA256 7a04fa870f62c9d955bf14b4e1d36647cda95e9980fbb0cdb0ea6cccf8148640
- MD5 95bdeee818ef7aa2effefe8fa5dd91a4
- SHA1 d39ea3a0aaa223d2bee73827d9b3e9eafd41203b
- SHA512 0d873c5bb5c201d0ae364d075bab1386433003a1b8883ec4f87c1b8287fc4276c3e880951cf0970a36fcb72468a649295ae9115a38acf8f09ab5a15e3b4bca0b
- SSDEEP 1536:nIsLS8ZIjOrOJ0ou3GerIUhj18Ehs5VqX25G5ClCQEiV2XaRodwTVCJ9XY:hStjOrOJGGMBwvqXQGYlawwBY
- TLSH
  T1B06329037B4200B2CE6747B18D5DB72BBBEC4A1B4486E71B531F08F0BB92526A55E2D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17
- Target
  $TEMP/Utils.png
- Size 255KB
- SHA256 37a010d9dc8f7e17948bf87c44a11f7a7e4e4813ba44e47b87ef81e926d3dcc0
- MD5 d0489b17ecc76d707f8c0e5864bf6560
- SHA1 ff85e350b4553432a8d77e022dd54436f2c48ff8
- SHA512 ce929b96a4a6158d2eec07d41feb0023d6c3d0bba4bce0f359bbe59b57a59b4cec7772cab16e2fd899f09ef53561991f3161619dca5e984ab126d5be9739dd80
- SSDEEP 6144:J4kOSG4O5zmU963+sZSri91gHehr/Q9ZHAFz+acSTtqrk:WMZozmUk3ZSuIHQIPKz7bJr
- TLSH
  T17944222EBA3EC2264E0D15A350667640735369A6E2053FF65459B35F3DB281BF30CED1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Rhadamanthys Payload

Family: Rhadamanthys

Deletes itself

Executes dropped EXE

Loads dropped DLL

Discovers running processes

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18