Overview
overview
10Static
static
3Spotify Pr...ML.dll
windows11-21h2-x64
1Spotify Pr...er.exe
windows11-21h2-x64
10Spotify Pr...se.dll
windows11-21h2-x64
1Spotify Pr...47.dll
windows11-21h2-x64
1Spotify Pr...v2.dll
windows11-21h2-x64
1Spotify Pr...de.ps1
windows11-21h2-x64
3Spotify Pr...me.dll
windows11-21h2-x64
1Spotify Pr...m.html
windows11-21h2-x64
1Spotify Pr...ng.dll
windows11-21h2-x64
1Spotify Pr...ng.dll
windows11-21h2-x64
1Spotify Pr...ng.dll
windows11-21h2-x64
1Spotify Pr...47.dll
windows11-21h2-x64
1Spotify Pr...eg.dll
windows11-21h2-x64
1General
-
Target
Spotify Premium.7z
-
Size
20.6MB
-
Sample
240623-vrvb1a1fql
-
MD5
9ecec152d8f5465e94bfc1415390ae6c
-
SHA1
f6da2074d8d90568b4cb7d3c6502aeb3748b14f1
-
SHA256
a64e052d1c68f9a610499455ff604189d9748b7246d7bf7903a92970f6036905
-
SHA512
025909f314c26b3a0341de070d650b45885462aa94d27f84272d653f3309e2f373a218952fdf88f86a4146c48d5e12343ee72c721dcee0bb2372693e89c02486
-
SSDEEP
393216:/gp6lryxZtvkx+ArgsKedsbtL8qsoCc06ogP1GxogPD6iXsuEtnozjF0jiN4Nqbh:/gcYugsK4sbGL606oq1+ogb6iXsuEtnC
Static task
static1
Behavioral task
behavioral1
Sample
Spotify Premium/DirectML.dll
Resource
win11-20240611-en
Behavioral task
behavioral2
Sample
Spotify Premium/Installer.exe
Resource
win11-20240611-en
Behavioral task
behavioral3
Sample
Spotify Premium/License.dll
Resource
win11-20240419-en
Behavioral task
behavioral4
Sample
Spotify Premium/d3dcompiler_47.dll
Resource
win11-20240611-en
Behavioral task
behavioral5
Sample
Spotify Premium/libG1LESv2.dll
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
Spotify Premium/locales/de.ps1
Resource
win11-20240611-en
Behavioral task
behavioral7
Sample
Spotify Premium/onnxruntime.dll
Resource
win11-20240508-en
Behavioral task
behavioral8
Sample
Spotify Premium/resources/LICENSES.chromium.html
Resource
win11-20240611-en
Behavioral task
behavioral9
Sample
Spotify Premium/resources/app.asar.unpacked/node_modules/btime/binding.dll
Resource
win11-20240508-en
Behavioral task
behavioral10
Sample
Spotify Premium/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll
Resource
win11-20240611-en
Behavioral task
behavioral11
Sample
Spotify Premium/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.dll
Resource
win11-20240611-en
Behavioral task
behavioral12
Sample
Spotify Premium/resources/d3dcompiler_47.dll
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
Spotify Premium/resources/ffmpeg.dll
Resource
win11-20240419-en
Malware Config
Extracted
https://rentry.org/pancek61111111111111/raw
Extracted
https://bitbucket.org/k34gk349g34g3/56j56j5j56j/raw/0f83a68fcbec53d90c5d0c17a582d7652b840e57/pan.rar
Targets
-
-
Target
Spotify Premium/DirectML.dll
-
Size
11.6MB
-
MD5
0b646906d2ea7180a3a7f74a40e74e02
-
SHA1
000010aca4859c42ec9cd87f98242bb6593650bf
-
SHA256
5d5975d43001b5838f4a46cea1382bb37d5aeb66002062964b677e64a3db16c7
-
SHA512
17bcddee315165bbd21bf245929e75db41632c2bff8692493ca361f3064b42e77d86cffb8cc59a2de7892f31e81676d2031fc55527eba42810210961be25bb83
-
SSDEEP
98304:5zfeFhssDz4pH0Vpoy3M0FgyPGodyY3pfYaIJAmHBpA/uJwb29DJDrrbVMqqDZz3:dfurDeuLdddfYTimHXR82LrrbVMqq9+W
Score1/10 -
-
-
Target
Spotify Premium/Installer.exe.exe
-
Size
7KB
-
MD5
eee2a79d3170f463e9697ddb8b97d41e
-
SHA1
818c82b1743c91f423c92742b54355b2058ff417
-
SHA256
a4569f2cabda528425ec397aef16d6f8fc15ca94664f6f98d738d0b3dc570b41
-
SHA512
139b6366a088d9aaa055fae4c7853c872fe4a31dfb7dc8e3961f144db0d712342fd4e9ef6f20e5f3cbb225a4f23c3ed24e55d144f9342398e8305f54a327d5ea
-
SSDEEP
192:nx92qvjK3xszfzzztCbxbsIcaqcINv/DvxIcaBlNtUqKwceNdM:x91v4O5CbxbbcaqcIND6cazNt/BcebM
Score10/10-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Blocklisted process makes network request
-
Creates new service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
-
-
Target
Spotify Premium/License.dll
-
Size
5B
-
MD5
b08a5c34cf0a06615da2ca89010d8b4f
-
SHA1
626a77d86d9d12d1772f788cf67c8e77fd9f797a
-
SHA256
04cc5b3b49a7e9e9b6c66c7be59a20992bf2653746b5d43829c383fb233f88fa
-
SHA512
5dce742cd0f649461b08f8f8018e0fa39ef19e813a74a91f434a15754a4fa8be83096e8fa49cf1828ac011220b7ad3724e7e4ea9cce7937a3168169d8e561b2c
Score1/10 -
-
-
Target
Spotify Premium/d3dcompiler_47.dll
-
Size
4.7MB
-
MD5
1e2f4329fa2e58be78f5fcde2aeea167
-
SHA1
c2ecb4d0542c49d9e906d6173f77349aaa4749a6
-
SHA256
a92f3bb1a4d846b38e8422d7c492f638e6bf47081facbb22c92568118938d5ce
-
SHA512
8ae9b45f7427d83b5fd0afa49c920f79fc071f362dab0a4ef72be0fd19f5243779f071d762a66ffc2180121ded618e571470d3eabbdcf21b4125cf0b04ea62f3
-
SSDEEP
49152:3uhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccG:ny904wYbZCoOI85oyIV
Score1/10 -
-
-
Target
Spotify Premium/libG1LESv2.dll
-
Size
142KB
-
MD5
b5505f1a0d0b678dd1198591bc74bc3a
-
SHA1
4312c487599c49bc53e2d83ca34561ac3b79b729
-
SHA256
08b34f11661de9e838ecd8fdf2780117e6b5e83edf24f5dcfae823a7e1fbfdd1
-
SHA512
804ebb36d26f4362f03c31071905b8da41cd0318d10fa9e1fcab191438afc4d7f79d2f6bc6fea2dd45073929b88a3bf467f9d3cc63f703a1909cc089a291853f
-
SSDEEP
3072:YZ8y3Lm1TcmyZ8y3Lm1TcmyZ8y3Lm1TcmyZ8y3Lm1Tcmt:GZ/Z/Z/ZI
Score1/10 -
-
-
Target
Spotify Premium/locales/de.pak
-
Size
367KB
-
MD5
cfc9d90273c31ccf66d81739aa76306a
-
SHA1
ecab570041654b147b3dd118829e2f7ae668f840
-
SHA256
8bd127d689be65e45bb8d2a2ff66698200da97835809c6b56ec9e2929b70618a
-
SHA512
c9a5058b34c4045ff1b7ae25f1f47bff14d06b3a97b7b1f30da65618ca7aeb0638d79f4e1cea4773cd92d9dfa7f9d2203e5734d0cfe11ee2d2a460d6cec18380
-
SSDEEP
6144:F+QNkAjzYyqSFaPjON3Be0mzBWCj0Xs5HgIxBI0gql:cQLjMyvFaCN3mzBd5xy0gql
Score3/10 -
-
-
Target
Spotify Premium/onnxruntime.dll
-
Size
12.6MB
-
MD5
f1ee7888561c223f128c864500098c49
-
SHA1
00c61eef1fd100dae39da16a57cb3047c286ae93
-
SHA256
af7c0811957ec3424f2610dd783ab7c91acc04d21c4e6ccd8c6e8a3ffad03187
-
SHA512
85a99e73d75f87ef22fa508a47a79d505bb06f33581d4fd8e2a04aae0695a959762258b34e7f89e546aa2d1a8703a1fe4e7aaf0d50544eae523a68347cf6f6d3
-
SSDEEP
98304:FpiWQI5i2CU4E4/CE26u0meURZKkr7/8U:TiWQI5+U4EO5mBjLH
Score1/10 -
-
-
Target
Spotify Premium/resources/LICENSES.chromium.html
-
Size
6.3MB
-
MD5
34999967f735b07e9cbcf6c397cea4db
-
SHA1
8001fcdd6ce0c6e5a3d91fd45e4c9726fa67f3e4
-
SHA256
c5a05048505c00af46c75fb5ca22057f09dce001eada3a756c3839d59011758f
-
SHA512
b6c2f722b6551231801e453bba8f9593d9f1a82edb305869ee07ef77f286968eb6ad5db1abbe750e88c8af973c362ee161aa5c591ea04ff39e4f4b34e6fa4baf
-
SSDEEP
24576:/PV05W5WS9YzHIlGMmfu626s6W6a6q5AHWeQFpD:F9n
Score1/10 -
-
-
Target
Spotify Premium/resources/app.asar.unpacked/node_modules/btime/binding.node
-
Size
118KB
-
MD5
13a2579ed95366185a6247c9e4b9f0cc
-
SHA1
61fef12da622484e44b3c9ddcd61706c9af00aa0
-
SHA256
98c51303c38dc03faeeba13f26fa3c6645d0c1a502b8a5d28177ce015dacf35f
-
SHA512
7aae5a45f5333355c81e4a7468d40c9d814a1b242c99a39747fea9b66e277dd1060bda290fc980e958beccab2ac0232fc4aba078426ac5ae39c19968ae8f58d0
-
SSDEEP
1536:OMwHUFyUCyB7KdX2teZOpSPtvdO+tYLZI2mAq+J6sWyd09dlgh7tBrdO6t2:hwjUCyB7eC8OpSS+tYLZI5+NMKFdO6t
Score1/10 -
-
-
Target
Spotify Premium/resources/app.asar.unpacked/node_modules/get-fonts/binding.node
-
Size
125KB
-
MD5
eeb1d1ea9fc3f870f292161cfa79850d
-
SHA1
ea4f4324245f9f4d6280ef285151f688221d6023
-
SHA256
149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c
-
SHA512
795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254
-
SSDEEP
3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG
Score1/10 -
-
-
Target
Spotify Premium/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.node
-
Size
118KB
-
MD5
6c12c930f974e5bc7872b58964f42359
-
SHA1
805c5c899c32535d2ee8b2bc12deefe5fdaae566
-
SHA256
094bfeb0692885f1e56bb363e1065099eab48a7988c8603fd6a3fb49ec88b09c
-
SHA512
f46c416e3f33e0526c2d4cb3df738f7c9b11fece350b90ca9613e5d86bae7a363dd20b80d62f5745a9d51773b655199537b09fcf47acf226f35002f39f1596d3
-
SSDEEP
3072:/WKjx2yp1tLqA1HB4kdeRqGmX5EMMi6leGS:3xBPVf1HB4kER4UFhS
Score1/10 -
-
-
Target
Spotify Premium/resources/d3dcompiler_47.dll
-
Size
4.7MB
-
MD5
1e2f4329fa2e58be78f5fcde2aeea167
-
SHA1
c2ecb4d0542c49d9e906d6173f77349aaa4749a6
-
SHA256
a92f3bb1a4d846b38e8422d7c492f638e6bf47081facbb22c92568118938d5ce
-
SHA512
8ae9b45f7427d83b5fd0afa49c920f79fc071f362dab0a4ef72be0fd19f5243779f071d762a66ffc2180121ded618e571470d3eabbdcf21b4125cf0b04ea62f3
-
SSDEEP
49152:3uhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccG:ny904wYbZCoOI85oyIV
Score1/10 -
-
-
Target
Spotify Premium/resources/ffmpeg.dll
-
Size
2.6MB
-
MD5
7f31b5234e44fac97d3c673a38c4c11f
-
SHA1
65dc18e0bce308608dbba3c76d84e266c9fa53e6
-
SHA256
0e751cd4312fab78d2c316860f1460875cd799e8d158f75934391c14ba328101
-
SHA512
83658e0275a8e1fec8dd0f98c19c3e7d37a7205afc3547fdc09c60f0feebe72d30ecb2b182e9ed17ceaf3604ecd77810e330eff4cb5e38fef8a27b8ea9db2467
-
SSDEEP
49152:zYuqVaqc35GHXVNtcZ44yODvSEbO/1o/GRRpYN4MJ8eIknusyUUjkU+jLtyTzQVN:zYLVl54yODvH/ySJUiLtyTzQVkU5qkJr
Score1/10 -