Extracted

• • Target

    侵犯著作權的圖片和影片證據.zip

  • Size

    102.9MB

  • MD5

    3b2edc37d0eae88df4e7ead247d5b26e

  • SHA1

    563237c6ad1aaf5d96ad8465d34e3f02c3742563

  • SHA256

    9438e10675af61c75dd1c6c6ee65a7a79e4f4e2acb8d9de8473a588a38085df2

  • SHA512

    cb1eb43a0f2530037ab66b31d5d93c152b83f0cbe0ace5f7f6bfe0c33385c3a9fc73c59f6b7dda874c2df1d29510991d9a1c65303730675e97e668695830a2f3

  • SSDEEP

    3145728:/9WmBuj5V9/97h+8ZYqk/t5YVuxflmaKameBjn9NghzrvuPaUN:ebmtzm8/BhqrvuPv

  Score

  1^/10
  behavioral1behavioral2

• • Target

    msimg32.dll

  • Size

    6.2MB

  • MD5

    1cd3af0e73daf4ec0d18a21945d94b0c

  • SHA1

    5756f5875365a49dae431ee32f34b5eecff6df83

  • SHA256

    affc80fed0ad2b288db4fb25488b631302a7c26eed698cfc197c43e54886e250

  • SHA512

    aacee19bc9f000f4d0f521582d576f11a29aaf46a9fc82d203bbf74f8f3e3cfab382690298ee90639d04ef1814ce5ed643aa520d807995a5f083196c0c8e7ce8

  • SSDEEP

    98304:A6vth6HjL23qzZ0+ca29gjYCUP5zCmstJX3kkk5HDiTk:ltgL2dhEJX3kk4iTk

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    rename_me.rename_me

  • Size

    130.0MB

  • MD5

    f158d3387c6e2cb1b482f7b7abee7e20

  • SHA1

    9aadedb8049339dd027a45bc733caa1f6f3dc7a9

  • SHA256

    c052369f476b624913e8aec1a3ba729d30b5d5f145c4c5c58d64f7d09cfa54b5

  • SHA512

    93e92533c93d966007eaf6fb35772e362326eb8bd321f1db28cfa98943277589a393081157a8832f162776127eb91974e3f93a2ea3475e936db1f228973bc40e

  • SSDEEP

    3145728:96lH+byk0ZggBznCh2HCea5bQ92NmDVr9XqnZGWp:

  Score

  3^/10

  discovery
  behavioral5behavioral6

• • Target

    侵犯著作權的圖片和影片證據.exe

  • Size

    6.1MB

  • MD5

    4864a55cff27f686023456a22371e790

  • SHA1

    6ed30c0371fe167d38411bfa6d720fcdcacc4f4c

  • SHA256

    08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2

  • SHA512

    4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb

  • SSDEEP

    98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz

  Score

  10^/10

  rhadamanthysdiscoverypersistencestealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence
  behavioral7behavioral8