Extracted

• • Target

    c5f6cf32d9df0a56c7d66679b0c9f92d83e3f72bd7ff381aa58017b7eb478d9c

  • Size

    6KB

  • MD5

    87cc744ba0415d7bf876f8a757d71579

  • SHA1

    a244571fc128820b1c98be6931b60363c804206a

  • SHA256

    c5f6cf32d9df0a56c7d66679b0c9f92d83e3f72bd7ff381aa58017b7eb478d9c

  • SHA512

    fb5a3af854390e9f3e8b89436f94bb310caa5d410ea78c26cbfcd6be2f2c6b69b85b862e59dc2335951b1ee2aaaa22f8095c24093201a900972c32cb4c6d3903

  • SSDEEP

    96:nmTGjilvkQHL0dKLAiU+7VJS1Ektt593ozNt:nmiiPr0QLArGqt9q

  Score

  10^/10

  purecrypterrhadamanthyscollectiondownloaderloaderstealer

  • Detect rhadamanthys stealer shellcode

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1