Extracted

• • Target

    5f58e87fee021cbaa9ecfae2d5f8709bd0934b2d2d2779a8f24993425fb20350.exe

  • Size

    1.6MB

  • MD5

    fa000351e26e17543f67e3dedc97d37e

  • SHA1

    c59fc4f489ac15d5a1d455abbf0c3c5ad6fcc189

  • SHA256

    5f58e87fee021cbaa9ecfae2d5f8709bd0934b2d2d2779a8f24993425fb20350

  • SHA512

    1bf517f2b0d3c156c2850f161f4bedf735361a8951d807b05eeaa711a0720031e545d5dd56f46337f059ef18bea1523ec1f5a5b96e83d6380eb74e6526bd0025

  • SSDEEP

    49152:cpUlRhQMnbfKk8QkwCRYhtkp0d0X1zJ5w+ufya5h:cpUlYEfKk8DTROk6dK1l5wF

  Score

  10^/10

  rhadamanthysdiscoverypersistencestealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2