rhadamanthys

General

Target

Loader-Installers.zip
Size

12.7MB
Sample

240610-k9qresff88
MD5

64f3480922f6da4495c4bde5a6538bf4
SHA1

16e782c455ede78723989b22f14b87a45d71a4a3
SHA256

f51688a42e05f47356c86c1b6b1623ee33c2d8855ce8e002e000308f4b5da684
SHA512

b86616c705c93d897c73009a7368d1935dde55166c612bf150347d992fa7eb433aa782c16e8dd57e858c7773a4f4fde860aff5e432cbba15e1ccc373987cafd3
SSDEEP

393216:7wyk3UwbXr/BPTImOq9WNpvaQFgv2pRz+nH7R9aND:3IUwv/BEmpWNp6wzmHFUND

Score

10^/10

Malware Config

Targets

- Target
  
  CFG.ini
- Size
  
  39B
- MD5
  
  24aae652215ebff6b6a4f03943f4eaf7
- SHA1
  
  d1375c86bd8455febaa50759a36bf6795c0beff9
- SHA256
  
  802cbdbb7c195dad3f763c38f21900a9006db3292fffc723b3cf75c10d239ea9
- SHA512
  
  11c48adf07c89d0ed66dcd3aaeb354ce354af78cd26ab3c0d36dad76a5359542ae0f5cc842510c82c3e3b974ef7bbd4c6293ce6a1d8d355174b81067e02ddba1
Score

1^/10
behavioral1 behavioral2
- Target
  
  DriverUP.dll
- Size
  
  685KB
- MD5
  
  081d9558bbb7adce142da153b2d5577a
- SHA1
  
  7d0ad03fbda1c24f883116b940717e596073ae96
- SHA256
  
  b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
- SHA512
  
  2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
- SSDEEP
  
  12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
Score

1^/10
behavioral3 behavioral4
- Target
  
  Loader Installer.exe
- Size
  
  54.0MB
- MD5
  
  7da9f4a912992fb26434573d65a1a0fc
- SHA1
  
  39a8bef04bc19ed39567039dd054174f5a6bfd1b
- SHA256
  
  060de3b4cf3056f24de882b4408020cee0510cb1ff0e5007c621bc98e5b4bdf3
- SHA512
  
  503d03b6b6654bcc1fd5a8dd6e0660bec06ac416509a6d5583cfd42168eae6adf2360f87a7b325140d4bcf430c799be1efce41c9763b992f9ac79f0a028bc445
- SSDEEP
  
  196608:Is6PAGLjQoTUlr/t/COz17LUU27lSalE8neeyh0f7Z+o3nPKAcfM2e1:IdPAGHXmztE0D8neewqZ+jS
Score

10^/10

rhadamanthys discovery evasion execution persistence stealer trojan
- Rhadamanthys
  Rhadamanthys is an info stealer written in C++ first seen in August 2022.
  stealer rhadamanthys
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral5 behavioral6

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Sets file execution options in registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Registers COM server for autorun

Checks installed software on the system

Checks whether UAC is enabled

Maps connected drives based on registry

Checks system information in the registry

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6