Extracted

• • Target

    Portable_x32_x64/Data/Packaged/Resource.dll

  • Size

    189B

  • MD5

    4427aeee68321d0f4d7befa74e669f83

  • SHA1

    4670003762a1c217c9e8ea48fcc53f2871a7c341

  • SHA256

    a9661f89b8d957f4e71cbe1ba0342a39e5b50a1d80d974e2e1b349a273967f1b

  • SHA512

    9d9156aa8fdebf19363fed2edb82235642c8c20549369470e44fdc0db41324e2160968fd7dd43eecce1ce3da9c03dd05cdefc8d903a9d0394f5ca9a73f5c5fa3

  Score

  1^/10
  behavioral1behavioral2

• • Target

    Portable_x32_x64/Setup.exe

  • Size

    251KB

  • MD5

    fe51917821ba0847a64c5467741ed7e3

  • SHA1

    100ee217a3a2d1b2b211fa214804bfa77c676765

  • SHA256

    54b3c35bdc0c3a426f6fbe5e06500738dabcdc47b9eaeb6548122af1f46cd2eb

  • SHA512

    4a8de56ff27c71f582d342ae82699e1b2b1b3958ff3dbf67c46dd94c35afd8b97cc7dddb3f04e6797a3b50d2ebba44b6ddee8c42174a09b83a808b9ba35f9137

  • SSDEEP

    6144:tpbIwepIdznDi8Har8HSDzYTk0zh6LM8wG4m7:fbIwewi8Har8czYTkbLZ4m7

  Score

  10^/10

  discoveryrhadamanthysstealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral3behavioral4

• • Target

    Portable_x32_x64/msvcp140.dll

  • Size

    642KB

  • MD5

    ba3023249b8d6ed0df30421780fc1d0f

  • SHA1

    6b6ddce795244fbc0bf25aa8387216898a406d57

  • SHA256

    23d4cf6d02126c05466abbc91eed4d7fc8ff99c8fea9bd8e68a44cfadc89a3e1

  • SHA512

    f6b177f218804ee862cbf6729b6d435442f9ffb9b980d6bb04a378c52d936245c726685234d8d8844e6f7c030704ba4bb0e15db26f79fc70b8557632d0687f4e

  • SSDEEP

    12288:o49le3Mnp52WBqf/qq3R5W8ZB4zmRzbawsViRUF95HdAx:ZlRp529f93PW8ZBS+zbR7sFc

  Score

  1^/10
  behavioral5behavioral6