General
- Target https://kms-full.com/install.php
- Sample240514-ygeeksdf93
Score
10/10
Malware Config
Targets
-
- Target https://kms-full.com/install.php
Score10/10Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
Suspicious use of NtCreateUserProcessOtherParentProcess
Blocklisted process makes network request
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext