Technical Analysis of Rhadamanthys Obfuscation Techniques
Tags
cmtmf-attack-pattern: Code Injection
attack-pattern: Data Code Injection - T1540 Credentials - T1589.001 Credentials From Web Browsers - T1555.003 Credentials From Web Browsers - T1503 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Regsvr32 - T1218.010 Server - T1583.004 Server - T1584.004 Software - T1592.002 Tool - T1588.002 Powershell - T1086 Regsvr32 - T1117
Show in Graph
Common Information
Type Value
UUID 92e64a17-65be-48e7-9d61-f606dbebf41f
Fingerprint fe351779053ba0d1
Analysis status DONE
Considered CTI value 2
Text language
Published Sept. 18, 2023, midnight
Added to db Nov. 19, 2023, 3:55 a.m.
Last updated Nov. 6, 2024, 6:17 p.m.
Headline Zscaler Blog
Title Technical Analysis of Rhadamanthys Obfuscation Techniques
Detected Hints/Tags/Attributes 50/2/19
Source URLs
Redirection Url
Details Source https://www.zscaler.com/blogs/security-research/technical-analysis-rhadamanthys-obfuscation-techniques
URL Provider
Details Provider Source level domain
Details zscaler.com www.zscaler.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 406 ✔ Security Research | Blog Category Feed https://www.zscaler.com/blogs/feeds/security-research 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 12 
download.windowsupdate.com
Details File 2 
avast.exe
Details File 5 
prepare.bin
Details File 1 
dfdll.dll
Details File 3 
unhook.bin
Details File 3 
phexec.bin
Details File 1 
license.key
Details File 1 
puk.key
Details File 2 
xxx.png
Details sha256 1 
3300206b9867c6d9515ad09191e7bf793ad1b42d688b2dbd73ce8d900477392e
Details sha256 1 
aebb1578371dbf62e37c8202d0a3b1e0ecbce8dd8ca3065ab26946e8449d60ae
Details sha256 1 
9917b5f66784e134129291999ae0d33dcd80930a0a70a4fbada1a3b70a53ba91
Details IPv4 1 
45.66.151.81
Details IPv4 1 
141.98.82.254
Details IPv4 1 
85.208.136.26
Details Pdb 1 
d:\debuginfo\rhadamanthys\debug\sandbox.pdb
Details Url 1 
http://45.66.151.81/blob/xxx.png
Details Url 1 
http://141.98.82.254/blob/is4mlw.suqp
Details Url 1 
http://85.208.136.26/blob/vpuu9i.7b4x