Extracted

• • Target

    RG Launcher.exe

  • Size

    175.7MB

  • MD5

    cb3ce412a9c4cb7f0cf20344fdb2f46e

  • SHA1

    bed9b9bedfe2f7d328b66fd9c5914ad8fa0f69a2

  • SHA256

    a0295663c005e7515aa5d3ef0af36efbe4fd1dce9fb31609037c4eb0ab68a014

  • SHA512

    5b92e1c448ab2f6b46c04d496207bbc843cb223db341ca493469907dc96206e02e9db95356fac6d75833c018d876417481c429b2def5dc9be54eec9cce288c26

  • SSDEEP

    786432:0C6zTLvV+8ym5CqWpQshx4i9vnrX5hf9RMFJKaRODgJZhybxJXZdZdDIll3S+GE3:0fTB/P4Dzr9v/1iFIRDgtmxJp1O3h

  Score

  10^/10

  rhadamanthysdiscoverystealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2