Extracted

• • Target

    9b98594e1eb4827c104c9f671d08af90N.exe

  • Size

    10.0MB

  • MD5

    9b98594e1eb4827c104c9f671d08af90

  • SHA1

    7955bca920581e5641a45071e2ba782f45c3b670

  • SHA256

    a935c0e21b631b068ee46e2a80dad3d8e537046ee596298c511c468df5d62553

  • SHA512

    4b24e9810d221ae22297830f67a90014b596e857fc9cbe4725d9626b0f977575a88769fd851b6d80b11963a53378e72992e4fb896a2fbdb2aae97112058f3fb5

  • SSDEEP

    49152:/7GZGHSOdOoyWzL/bI7UAnuqSrtdBDmfKtT6ZLOkALP7fi1Hcl8FgWlPaMWoOCpd:zGZGy0FfDEUYuqSvBDmSokkkQHvYa7

  Score

  10^/10

  rhadamanthysdiscoverypersistencestealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence

  • Suspicious use of NtCreateThreadExHideFromDebugger

  behavioral1behavioral2