Extracted

• • Target

    rh_0.4.9.exe

  • Size

    456KB

  • MD5

    cf4914d021c5a5378428d6f5d3b1c57b

  • SHA1

    2dc95dc667cf4c49f78b4b8033cec85d889fd069

  • SHA256

    f0f70c6ba7dcb338794ee0034250f5f98fc6bddea0922495af863421baf4735f

  • SHA512

    c07408df7b0bb3f5f57482d9d93b79654e1eb1cb5e938c1e814b25ca6bdf5729c5de85c85b4e91116c38ba875b4611372f6452d1d2ad1e3f2be59b62009fae43

  • SSDEEP

    6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+n:2uWP/BZUyoLu8Agsmxwrvejkd2

  Score

  10^/10

  rhadamanthysdiscoverystealer

  • Detect rhadamanthys stealer shellcode

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  behavioral1