Extracted

• • Target

    ementhaler.update.exe

  • Size

    21.8MB

  • MD5

    ab5a93d844776c6be7b172dca3cad543

  • SHA1

    b0056b6766a6f948e052930b17e577c157b7c3ce

  • SHA256

    759b0415519b5614289e59ad876353e87af67bd427004ade714d4c72a8fc16aa

  • SHA512

    51fb84e5a4710b6b7abbe5fc8f6b12ade3718bb11815b13cd758eb67d85f61b85ac05efd25a017026ce841f9774344b9be118d3f512e64b4e72c045de4054528

  • SSDEEP

    196608:n14r5TXfhoeNMdRqPUQgOqU0PqaVVoJATCWH1292ukfbLgokl1hiMjqkmsXAWVFv:n2r6UDqU0yYwx19jq+l5lmp34bFf

  Score

  10^/10

  rhadamanthysdiscoverystealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2