Extracted

• • Target
    msimg32.dll
  • Size 100.0MB
  • SHA256 2ebb94917f88ecd55f050b10407315098cc1586531836a952214bb8f4113468b
  • MD5 18f1a910ba13acd4f778cc64de5914c3
  • SHA1 387436d406f805289d31f44a4daf413c0d82211d
  • SHA512 7dcc6e2ba89759c2a068d0286ed04584f8d5545b1208ca9bd1e066c6963498b2d20240e497a832a4b7b6b83ae84300fac6bc907a30a5aae56404b75076339977
  • SSDEEP 24576:P1Cbm39DOBVXaIFP698DWk7PVmrOqF1HLOkVyLP7E8Lr19Eq+soYTtweRvrXSTtV:iJVWAc6wZLOkALP7fiqHoA5ETtI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral1behavioral2
• • Target
    rename_me.rename_me
  • Size 130.0MB
  • SHA256 c052369f476b624913e8aec1a3ba729d30b5d5f145c4c5c58d64f7d09cfa54b5
  • MD5 f158d3387c6e2cb1b482f7b7abee7e20
  • SHA1 9aadedb8049339dd027a45bc733caa1f6f3dc7a9
  • SHA512 93e92533c93d966007eaf6fb35772e362326eb8bd321f1db28cfa98943277589a393081157a8832f162776127eb91974e3f93a2ea3475e936db1f228973bc40e
  • SSDEEP 3145728:96lH+byk0ZggBznCh2HCea5bQ92NmDVr9XqnZGWp:
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    撤銷版權的法律文件屬於香港華納音樂.exe
  • Size 6.1MB
  • SHA256 08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
  • MD5 4864a55cff27f686023456a22371e790
  • SHA1 6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
  • SHA512 4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
  • SSDEEP 98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  rhadamanthysdiscoverypersistencestealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence
  behavioral5behavioral6