Extracted

Extracted

Extracted

• • Target

    298e8a80.exe

  • Size

    236KB

  • MD5

    6e1c938d43c035a71ad43ab31736a022

  • SHA1

    6c94b9affa15d4bffe3fb378f04f5c8662145982

  • SHA256

    db14e897b3b268f92bb15f0720d4ec0c191949b660e966027cd6ec656c00cc26

  • SHA512

    62cfac64d14447d485a224c0a028f03b2c3fa49dbc121258d16850f8c9ec354202207f49736ebaa7df45b0b10b958775670045422a95eef0400c8f559a980c37

  • SSDEEP

    3072:JEfCoNfGdWSv8tCdD3TMEqNSS1GWRlztN0o5fDOKLDwYPDpJKJRfi/:sCogWSktCBTM54iD5DOKoYPDWJ4

  Score

  10^/10

  smokeloaderpub1backdoortrojanrhadamanthyscollectionstealer

  • Detect rhadamanthys stealer shellcode

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2