Extracted

Extracted

• • Target

    a83e7ec9997f8e98ae0a3e27c20430d9711215bc71591406688312f8663c7e1b.lnk

  • Size

    1KB

  • MD5

    6195bc34ba803cfe39d32856f6dc9546

  • SHA1

    7df2be096948fdc9590658a6e16a15250e5f4973

  • SHA256

    a83e7ec9997f8e98ae0a3e27c20430d9711215bc71591406688312f8663c7e1b

  • SHA512

    14418232686d2ce0dfc4dbc018716867ced108ba3054e6023764608772ca92af7d4be918773747b63900371cf861fb3db872e4f419f427b35c5c61e9b8d8c36b

  Score

  10^/10

  executionrhadamanthysstealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to execute payload.

    execution
  behavioral1behavioral2