Extracted

• • Target

    a54f7c373754274a49006f8f34c1a92479006ed4a94926ccabec704f8a3c770b

  • Size

    7KB

  • MD5

    9d338d9096fbb6a26ccbe6d6f85f7510

  • SHA1

    c5f466becfca25bb9a23bb92bb1d487e0c57daa1

  • SHA256

    a54f7c373754274a49006f8f34c1a92479006ed4a94926ccabec704f8a3c770b

  • SHA512

    32814cd0647db555bbcd7048de1e3ca3d173ace20d743ab360f81947fea91b414057f47d6da4cef87541bba2831cdfd240a0e9766ac3a5d9c765929ffece3ddc

  • SSDEEP

    96:nBt4EMrZ4+NDLLOd+KnuRZTnqx1TkMozWtIgwCRXzNt:nWC+NXLC+fT+kMozWOHoB

  Score

  10^/10

  purecrypterrhadamanthyscollectiondownloaderloaderstealer

  • Detect rhadamanthys stealer shellcode

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1