Extracted

Extracted

• • Target

    8c1f6cb3d4124612705c2b607a07de101ac025a9a969fe4f8076361d63ddd0d4.exe

  • Size

    1.6MB

  • MD5

    0de6f1d98b72c2b6dd14f1de17212162

  • SHA1

    496a24d09fba3bc5414365e4ac32c04a2b9391e2

  • SHA256

    8c1f6cb3d4124612705c2b607a07de101ac025a9a969fe4f8076361d63ddd0d4

  • SHA512

    96ba787de04bdb05f8dcf7b6e954404d1a67f589e5e80b4cc5162a5b9a827270e10e47ea13f2d5b5bcde6a1a510487583a00dd3f5fcffd641a1957a89309d3bd

  • SSDEEP

    24576:I9AmP6qNqlGVRFqeMxY400MAuZo7Lnm1todLMtKSHZynPtYy4IN71lyg+Fwzr:Ib6qNqlGExY38AN/Zyl53l1lyxqzr

  Score

  10^/10

  discoveryredlinerhadamanthysfebrum2infostealerstealer

  • Detect rhadamanthys stealer shellcode

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2