Extracted

• • Target
    NitroClaimer.rar
  • Size 8.3MB
  • SHA256 587322c9740d55c91f25992cdfa74bea19ee360e2c435a2bc099f02605166dc6
  • MD5 ede1266566f1f5b72445b54fdd777871
  • SHA1 03174101545f6d9b39a39628c851ff217fbf23a2
  • SHA512 5ee0d863d74d407b196ac3480e0921ef77c0c084a626e85cb0c16c2b09ef62c1d831debc87b4a0b6c5d7d71e3e778c7e5acad8d374eb922a55589f66794f2829
  • SSDEEP 196608:mdKKD1YRg1PGDmUfU6ZiJNv6hZGULG+LOFhf3ion1lElSN:w/+RrFM6ZiJNvELLG+L0/BEkN
  • TLSH
    T1159633BA42ACD8C328FE2BD0049A14697DC59B49DFE4695BCF86D0D0E7A09704CCEF25
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1
• • Target
    Qt5Core.dll
  • Size 4.5MB
  • SHA256 7ab15d298cdd7185f2cceae2613715c54a54861fa788bb2de3d152eceb484288
  • MD5 b4f2c1be9ac448fdbb6833b0fba3bb75
  • SHA1 e34496261619f6dc70efd08b0f3c9c73b3dfee50
  • SHA512 be478f77214590ffe6360ee4b9e3c20e45d5281973cfbd502674dbdfb5afe62ec9b0ae06418f4523dd73fa4573d92c52100cf5c3b730ae1bc8ff3f34d8e1860f
  • SSDEEP 98304:0dS/SBS/PayG3fVkp9PJsv6tWKFdu9CPDB:/wfVUPJsv6tWKFdu9CPN
  • TLSH
    T185267D93E79781B2FA82827648EBD22B0576AD1547019AD7F34C3A0B98716E13D3F14F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral2
• • Target
    Qt5Gui.dll
  • Size 4.8MB
  • SHA256 55faebb8f5e28cde50f561bbd2638db7edcfd26e7ee7b975e0049b113145ae38
  • MD5 d9b78f4b2f8f393c8854c7cc95eae5d8
  • SHA1 8d648e7bda5b6bf7b02041189b9823fe8d4689e5
  • SHA512 6e76b524a56cc9bb5ae4beeedd41a48c35cf03c730752da3cae49862cb7bc3c17283099c39787f5933c1771eca7c2e651d92b961de7f43813f026eb295c90c81
  • SSDEEP 49152:PcLeg66Ry8jdAYbppzo7Tzj1/JrRbkwW6Ydzzr3YCWizxCqDRkU9i4g1/JAyn:kLrBpr1o7bRyfdzzxz0NTA4
  • TLSH
    T1103619D1B1827173C9A2D3BA670F263FD0A6AD56C30482C3C655AEC558743FA1F7BA06
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3
• • Target
    Qt5Network.dll
  • Size 840KB
  • SHA256 335cec3a5f9082f083190660932b6641f682f4c5818ffbd6ffa98c9d0c24e0f1
  • MD5 0fdda3a8c8be28993b156b24b300ccdf
  • SHA1 57fe6cfd0b28708d23ae560675d4c462127722c8
  • SHA512 4ba8b28ac903d087344185b77144bfcbcd5bda11efb2a8d45b942363b8a13c7c4fb56820644166c7556fb44b68a8786ebb10b8cc4b3557247aa85214289e4453
  • SSDEEP 12288:/fGeWXoifZwygBFp9RsVqSA3jk1x5X+JPnk4PpazkoLhVY9hqivwlsBNzARfG2:/fGeWXoiBwHbHEgqM9BNzARfG2
  • TLSH
    T12C055B52B2CF00B6E58D61FA881DEF67E63CB114470656DFE35CAE1663213E11E3E286
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral4
• • Target
    Qt5Svg.dll
  • Size 253KB
  • SHA256 ea31035fa96ba656d64b58d4f1a9dd210df7154afad3d4f96ee36b41584e4360
  • MD5 06cc5d18a496520e05bcfee1e3169535
  • SHA1 98ba5d0ed52499a845038c3b4bcba356b9339f11
  • SHA512 154a2fdbaa045df6289476420cc4045905a866cd54d756dcc09e0ea79f2cec7f33c748534f47c827841e35c35f71d462cadb801a6b99bf72c162c075d786fdbe
  • SSDEEP 6144:kKD4dwpLEE61jMW52NP5xwuMnyOWYGcy8Dv4Cnke+9oCsGhvdw61IwxP4zd:kKD42pLEE6mw2NPnBMIBrU
  • TLSH
    T116444B52B2424DB1F48BD378591F5A579C3EB00A037A83EBA3D99C21D4683F76DBA341
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5
• • Target
    Qt5Widgets.dll
  • Size 4.3MB
  • SHA256 400fa69aa8803f6c3a6f9a5fc956475d0396095c4b6d4665b7aa29bbcb8e3640
  • MD5 f697ffc85fb86d72654c4f5ba4e1bdc2
  • SHA1 670657f598d408ab232dec75be6fc7983bc5ce4b
  • SHA512 47513892c22a193c51ecf09c8f3e4c4271a92be33b7b7d535290ea75a1498c5531881a26a85dbf758361e6892abf12a796f1c5c284a34f1d173d61d2012325b7
  • SSDEEP 49152:Zhk8cs4FhK1FKBxR8Lcdm0OTqZ7uA/GrXHIaTU+cDZ0V37SUJ:7k8ymoBxKAdmL8yONaQi32UJ
  • TLSH
    T180268E83B2C101F1C8859275491FEF5BC5BBB1164B5652DBE38CEA0368683E12E7F687
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral6
• • Target
    libEGL.dll
  • Size 18KB
  • SHA256 0ff1d03926f5d9c01d02fae5c5e1f018a87d7f90a1826de47277530bfc7776f8
  • MD5 379358b4cd4b60137c0807f327531987
  • SHA1 b0a5f6e3dcd0dbc94726f16ed55d2461d1737b59
  • SHA512 097c08135d654596a19ada814ad360a8c2374d989cbd7094c6acb092e9854abf1f1d878d3da72b66c4c75806586bee7fe04d555a1d82db170725bdbeadea7d50
  • SSDEEP 384:rLyPunoshzdtnbuH0aXOk0GfZh5g+zCxU:rLy7s5dJuHHOqhyy
  • TLSH
    T1AC821AB5AE181B02DEC50AB587EADE23AD7176809F57C3F330A9826608D13D3F57914E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7
• • Target
    libGLESV2.dll
  • Size 1.5MB
  • SHA256 6765d163fae52331dfdcccab371c9b8b5cd0915bfdb14bbf2ca5d3f42bb29f4c
  • MD5 aebbd25609c3f1d16809c02f12e99896
  • SHA1 7675d0f61062490b8c7043a66a8d88d5d147f7a9
  • SHA512 a441ae0fe98ae39ed7fd1feb410bcac3aba9179242c62166190926588b97e11f0a3442d0619c6a2f6070e336a82d7fcabeb89461ff15fe878da13f2a57710f87
  • SSDEEP 24576:IGyEmXb3NBT+BZDQnVjDuBy8aTnilzT8QreNdJU8GAeZRyRWh:I8mr3OaDVXnilcQreNdJU8GOWh
  • TLSH
    T16F756B21BA49C17ADDAA12F29D3C6F5F510C8AA807B950C7E3C81E6D2D715D32B31B4B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral8
• • Target
    libeay32.dll
  • Size 1.1MB
  • SHA256 7581f48b16bd9c959491730e19687656f045afbab59222c0baba52b25d1055be
  • MD5 67130d64a3c2b4b792c4f5f955b37287
  • SHA1 6f6cae2a74f7e7b0f18b93367821f7b802b3e6cf
  • SHA512 d88c26ec059ad324082c4f654786a3a45ecf9561a522c8ec80905548ad1693075f0ffc93079f0ef94614c95a3ac6bbf59c8516018c71b2e59ec1320ba2b99645
  • SSDEEP 24576:CBULPHc9UKJayhv6uaDGXcRY0Pt4eY/qL6I4tPxVCBfe6w:L09UpyuDMaoHI4tPxV56w
  • TLSH
    T116458D07BB819AB2E9CF427D25B7477F893356189329CAD38AA135918C715D0A73F3C8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral9
• • Target
    locales/.en/_23.cfs
  • Size 97KB
  • SHA256 6b04a9a3b58c6349e0871147fc9427577ed1d27243560ede7dc423aea893f342
  • MD5 7ba7ff3536a2bc906de3016d8db76452
  • SHA1 e8eb5c043f7a23302c4be2d72c2574543cd3865a
  • SHA512 88ac10a5999fdaacab0c8c4fc1073b1e164539a05be30316d27ed0ced0971e6854063c29714c8dfed9f1f9da86ddb54322d506567acb54096214408c6e9dab1e
  • SSDEEP 3072:7eQDdjUlAs6pjCJiaickfF0h79DzxUXKhp:9RUlHGjC00h79DzWXgp
  • TLSH
    T1C4A34A43E0333493FE45017386679A0A37A1B3876E63B34A6BBD5368DB231C64FA2557
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral10
• • Target
    locales/.en/deletable
  • Size 4B
  • SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
  • MD5 f1d3ff8443297732862df21dc4e57262
  • SHA1 9069ca78e7450a285173431b3e52c5c25299e473
  • SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
  • MD5 SHA1 SHA512

  Score

  3^/10

  execution
  behavioral11
• • Target
    locales/.en/segments
  • Size 28B
  • SHA256 1384d654fc41f52d271b28a517644fb64f084ea2e0cad132bd0536cfc8a5e951
  • MD5 f0ff4aa435141cdf84fb9427e7e8a7ba
  • SHA1 967b548060c73ee4d24c8b021b1f16c3940465ee
  • SHA512 259bb4c788b0e43cdcfddc9d02f6985d5af752d73d501bc5999ad77801cca597954faa879f3e16e7e2ed1ca65082497d3b395a4927ecd4d32c652b69731a225e
  • MD5 SHA1 SHA512

  Score

  3^/10

  execution
  behavioral12
• • Target
    locales/en.qch
  • Size 1.5MB
  • SHA256 0e4ca84295781aacc97e5842d13f4cd71150b3373feab486124c6d2e3bda00f6
  • MD5 32bf7886e31b82df13b7f43cb09fc413
  • SHA1 0637a4b4d01fb42fb0ebcffda8be6dbe87ac23d9
  • SHA512 0a352c6732eb97d92cea123f7a539e6b43994625a1119666e8ec3d0c53e7ba2709a98659355c6e81578e32dd7705db6c0aa0cd3a5ffbe2c61b6ab645c41157f4
  • SSDEEP 24576:mpbpXVUXODT0f6I87HCoot6wzmdqZ4RpFlHP9f7dhBt0zMklqIBHZN3elaWn0gjb:x+Mf8HIxmR15hBqzFHH30aWnLGH0B
  • TLSH
    T194752342874BBE1BF78B4634B83A1611DD33363DD122D229711DCA996070BA611F9FAF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral13
• • Target
    locales/en.qhc
  • Size 8KB
  • SHA256 50edda5e45cbf3bb3af6497d2d0f3b7f4e3eda12efe2ac9868f02a21f5f9d38f
  • MD5 453f1ba3abb0ed88fd9ea9cfc33d80cf
  • SHA1 48c1adc2fcb5a01f6fb876e768e28b6e3a6b8f60
  • SHA512 d3b4df1e0bbd4478639ad5c56778b30dc2f1c6b3143568eddc44e031ad676d9740b326be786c7ab4d78d1adafc83b4f4e2c88569d9f471e1e9582f10e11bed2e
  • SSDEEP 24:rVmNpHnM8hq8FqeRFFFujivFhMutbgl284IqmmQxXHiedmXZVnyLXrmUNmXM:gHn3qUqeRF/u+dd62xIqmmQMeWGmUmM
  • TLSH
    T1D0F1C0D647197432FED2C1BBF41212351D38228E0073C8F168AE62AB08535869A5BCFF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral14
• • Target
    msvcp120.dll
  • Size 444KB
  • SHA256 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
  • MD5 fd5cabbe52272bd76007b68186ebaf00
  • SHA1 efd1e306c1092c17f6944cc6bf9a1bfad4d14613
  • SHA512 1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
  • SSDEEP 12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
  • TLSH
    T11AA45B237B864CF2D19E53B231C9531557FAFC6441B1F343ABEEE1692FA6282E123611
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral15
• • Target
    msvcr120.dll
  • Size 948KB
  • SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
  • MD5 034ccadc1c073e4216e9466b720f9849
  • SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
  • SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
  • SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
  • TLSH
    T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral16
• • Target
    nitro.exe
  • Size 448KB
  • SHA256 fb60104722bd3e978deb9f646a66c645669b56976f3860422151936945104b0d
  • MD5 247e118fea545a3c2fe66e2f6cbb909e
  • SHA1 9b3111d641b4d298c1929bb854fe625dce04a31e
  • SHA512 339d33716e0906b40ec99e959f364681af828d9e4c6756955ca20d4bd309ce534e77593d9e662fbf15b848f480dcd6ca73d94407499b067e1984d0070af96078
  • SSDEEP 6144:5YD/SKiChZJwLEm/8hXOrPM90O0UkoGBnjCdbGeFhhYftgpN9J2Gox6KX2WIUvg3:iD/x91wiGM9YNnGFn/ym9md27XSgBaQ
  • TLSH
    T1B2A4E1A66396C713F5540F7A0B68A8B28798BF5C6C134E4EBA7672CB2135D0C053B35E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryrhadamanthysprivilege_escalationstealer

  • Detects Rhadamanthys Payload

  • Family: Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Suspicious use of SetThreadContext

  behavioral17
• • Target
    resources/app.asar.unpacked/output/FocusManager.node
  • Size 258KB
  • SHA256 ba4d22ae9f6844ab4425fddb34fbf8b2f69c8f2a3e6073b93f11cbe478485ecc
  • MD5 40ace82cde07ce235b3118307924f072
  • SHA1 3076340eaa35029b3e8677e3d489cbdbe283b905
  • SHA512 d146a2b026df0c674500b9e1f0a7bfbcb0e047eda6c7eba5a05bfbc45a7cc8618e49928caf71ad9779c1c90004f87a62a650b29f4828e716d9cec37eaabea192
  • SSDEEP 3072:2pTcuwHqOc49+mIAcQOxpdC3CPxy9QK8td51G6dCGJp2VEK4PVSHoY46fvUrg7RM:2pofCg+LQOzdCyIqK8td9dAPohpOo
  • TLSH
    T141446B5973A40CB9ED77823DCD534A06E7F2B8560730D6AF03A0466A5F277A0953FB22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral18
• • Target
    resources/app.asar.unpacked/output/OafIpc.node
  • Size 281KB
  • SHA256 c3a76339639b0d9d659c888df827ae68ba10c387e35abd8fe63fcd467f48177a
  • MD5 6b6a434af560cbe99566a87fec59c418
  • SHA1 be51e9d0a4ecebc4ac3fef8a2ec2572d70c9a7b4
  • SHA512 35f222ba62da4234303e22c240e9dafaba144e38a0ef96315b9640f8fd605e1d29131149813d70c846ba8ff47845f27f7cedae4923e82c0a951c389112adb69e
  • SSDEEP 6144:/Ei5exiY00E3oJAb5KAMPrPYdYsxoh2kYDRnotF:/ECex7ioJAFGAzxocaF
  • TLSH
    T1E4545A5AF3A508B9E477813DC9538902E7F278560771D7EF03A446AA2F237D0993EB21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral19
• • Target
    resources/electron.asar
  • Size 258KB
  • SHA256 9b7e287bc4af0d0d22a80eabb2f9de3bab942a0bd7a68ac0c47a507ca91b58a8
  • MD5 dd9512340601019a865bc49bcc1f515e
  • SHA1 dac0dca8ecd0b6a6d5690c2d2dad60e8578f5ea6
  • SHA512 4a5f13efd7c7d66d8d4aa556e5ba4eaa0a51f85a29417ae31b81874e290367da2d380c2afd7ed8fff182e986d05db8f66158817d57a796de5744ffe4528f1b5e
  • SSDEEP 6144:w2PumPoX8cr5U3wU9EW+w8757tfJ1bxZLAHRkc99FZ:chUGJ1ba1993
  • TLSH
    T1A744C65525FA21250757B0BAA94B6107B73AD013601D9A60BCCC87E4BFC467882FBFED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral20
• • Target
    ssleay32.dll
  • Size 270KB
  • SHA256 5c2f10a772edfbeef8a5261b8677e68c4194cb87f3cb9bc319c8da75cfaefa3f
  • MD5 df38eb2002e5979e57babf8b4f6a2f82
  • SHA1 219d5837f6461688122d637bf67f041fc6c19aac
  • SHA512 da4b6ec820f5886102577a7e98187ed45165ee5373504fb4f610cfb47eb2ad6e0b75d868464df4ee8b97f506c2f493a1d3bf029c184c08b311dbc1b76c2a37f6
  • SSDEEP 6144:0xnT+R40IInTyFxvYlBtCikIK3gb/VuLXyJxm11VMaorgpa7ivoQXoYwWAaHeeT6:6nKR40IInTyFxvY3tCikIK3gb/VECJxD
  • TLSH
    T154447C43F29146E3E9CA4770217B577A3E3E6A156318C5C7CBA15DAC8C322D16B3D2AC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral21