General
-
Target
https://github.com/Miedev/nitro-sniper/releases/tag/Download
-
Sample
240620-we7bgatgrm
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
ps1.dropper
https://rentry.org/lem61111111111/raw
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
https://bitbucket.org/k34gk349g34g3/56j56j5j56j/raw/0f83a68fcbec53d90c5d0c17a582d7652b840e57/lemon.rar
Targets
-
-
Target
https://github.com/Miedev/nitro-sniper/releases/tag/Download
Score10/10-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Legitimate hosting services abused for malware hosting/C2
-