Extracted

• • Target

    cc00a259ec4ebde015fe0fad59f369ae23def081caa787ad0652f7d6b2fe6de0.exe

  • Size

    2.6MB

  • MD5

    421700a2d6d8516013d87e04628d2802

  • SHA1

    f738ae62f1016c0667115665c42e71d85cfb4d38

  • SHA256

    cc00a259ec4ebde015fe0fad59f369ae23def081caa787ad0652f7d6b2fe6de0

  • SHA512

    c411036515d4046ba62370c2f27e32d414273dc2e4004b9c4396c3518f951ef97c717ab532dd52100f2950e137249462495b376b8d89adde4c3f89292e9f70e6

  • SSDEEP

    49152:XlnKF46Fm2gROSeQ146cDPM2vCVapdoqwicf1/y36sbwAE1JgZIEST+eLAq8Z7p3:Xld7wwgZRt7mUz

  Score

  10^/10

  rhadamanthysdiscoverypersistencestealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2