Extracted

• • Target
    setup.msi
  • Size 8.4MB
  • SHA256 628377d7d9cf145a40adacf9cd59529fc449c5ff71b67dc2c6439df7bcfa3594
  • MD5 c5d5a704560d46bc2ea78c6b9447db4e
  • SHA1 89b08a25d5f5375172f98c467a11b95f87198654
  • SHA512 37ebb93341dea5c75002a49512996443e79b2f94dc96dac62d9974c8bfc2c95f1be5ce66748e0787e6e9e2a131b792ebee7b30eff8ee8b5c83bd7bf2607d3fae
  • SSDEEP 196608:4N7gYGIfVlhQ+gtODuwjWT6mPTTAQq/6mkJI:4a3IfVlhQ+glwY6ATsQpf
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  rhadamanthysstealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2