Extracted

• • Target

    ef76306c22da2d0636a17d5b9b7e5dd895f507bcc186e1ac025e50d1cb8e90c3

  • Size

    19KB

  • MD5

    24f7c61116bfe868c1975f5547c2dce6

  • SHA1

    1dc1965d2b31b8179106953f019cf92bad4cbc9c

  • SHA256

    ef76306c22da2d0636a17d5b9b7e5dd895f507bcc186e1ac025e50d1cb8e90c3

  • SHA512

    f2baddae18f88d46faf54b7ff2d66a1105b9d10c0c4162407b2e77ea18d8a040ac72599f9f648923b773cf9067f4041420abfe272e86b99160f45cbb4b7463ee

  • SSDEEP

    384:Z/f4LIB4GY6Wjy86ysDt2evcYNIFaU4AXg89S+:Z34kCt6Qy86pD01++

  Score

  10^/10

  purecrypterrhadamanthyscollectiondownloaderloaderstealer

  • Detect rhadamanthys stealer shellcode

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1