Extracted

Extracted

• • Target
    c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a.lnk
  • Size 1KB
  • SHA256 c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a
  • MD5 b6c511480d3c76834e42b773836e76a9
  • SHA1 f135c8ece764465c4e9ba8fded937f0ad4a5ab79
  • SHA512 f11d8780b11eee262276b0f16b65504b1f1e31ba6a25bbf7af3577079121a94f17ddcfb49fdbda08ec3c438bf1b2faa10b49281d29168f0d541cef089558c18d
  • MD5 SHA1 SHA512

  Score

  10^/10

  rhadamanthysstealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2