Extracted

• • Target

    boobee.txt

  • Size

    156B

  • MD5

    32ed85782dac5ad9e97eee17d5a3bf5d

  • SHA1

    f40f564a3265f90a1f41d6ffcfddf1d735d45dbf

  • SHA256

    35dcb543ce32c17153d4401abc5da15d8c8db7b16d72c6e6dfe993eabcc87f86

  • SHA512

    dcfc8e3084551e8a3b002c62ac54b7ae750940412faff211400e27ecb3d2918392af8ad6cc00921ddf8944549e526cd539005899395af5a5227f2942b74026a4

  Score

  10^/10

  rhadamanthysdefense_evasiondiscoverypersistencestealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Probable phishing domain

  • Suspicious use of SetThreadContext

  behavioral1