Extracted

• • Target

    InstallerKms.exe

  • Size

    68.0MB

  • MD5

    f53efc191a90dd0ba78c961b513efb56

  • SHA1

    0a30f6b17900dd62ba3c76289ae7f427dd8c26cd

  • SHA256

    9f18caf887db4cccec90f1d018538b77fd5b6e2f7bcaaecbd66fee016f98e10d

  • SHA512

    a4b05a36ce2b58821a14d2f13d176756e0293e777e50e052a52a0543cc2fbee93ae4b0f46af21aa4b5ba86a5414ebc400da60201f25c1da8820620ad408e67a7

  • SSDEEP

    786432:qxGBxG0xG4xGRxGXxGWxGmxGjxGBxG/xG8xGvxGqxGixG:qEBE0E4EREXEWEmEjEBE/E8EvEqEiE

  Score

  10^/10

  rhadamanthysdiscoverystealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2