Extracted

Extracted

• • Target

    Factura_SA161.pdf.lnk

  • Size

    1KB

  • MD5

    6b602c96ff01c4f55c7a625b2358a988

  • SHA1

    af42a6e2c1b97a958cf9e50a30cdf02221c07098

  • SHA256

    e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc

  • SHA512

    a793e118ba79adfe4370dd9a7f20dc90e64c3edc80a2f7fce052241c311e59fb15e71d4f1e38c60c9730cff6af9583c3fbcad9320f69968e8b90d7424036af95

  Score

  10^/10

  rhadamanthysdefense_evasiondiscoveryexecutionstealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indirect Command Execution

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates processes with tasklist

    discovery
  behavioral1