Extracted

• • Target

    6b226cdede731e178c299020f38b386e347638c1a59e7c7857fa1f7bddbca5eb

  • Size

    6KB

  • MD5

    30fe6fb1dc8a5a502a5f5329e1c9916a

  • SHA1

    5c8469f036e5c49551bef187e0ef9eb2eaece686

  • SHA256

    6b226cdede731e178c299020f38b386e347638c1a59e7c7857fa1f7bddbca5eb

  • SHA512

    cd9a2420349921226dcfe3051bb71407707858620e492146df37b86e004ece0b06888dfa00e9532c8ac094be821dfe35615da16860cc42e3b5de84bac08279b3

  • SSDEEP

    96:rrGrR/SsBZqnORNYxe+f2G8LJEu9ZtIOaZ1Cqkkv7t893ozNt:ril6OZzserLJEIa7Nv7eq

  Score

  10^/10

  purecrypterrhadamanthyscollectiondiscoverydownloaderloaderspywarestealer

  • Detect PureCrypter injector

    loader

  • Detect rhadamanthys stealer shellcode

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1