Extracted

• • Target

    rh_0.4.9.exe

  • Size

    456KB

  • MD5

    5adcfa28ba6d424847d12c246c7b19f8

  • SHA1

    ae451b00d9ef359148f68d8ec0a3dac0ba355f9f

  • SHA256

    91ae301f30a2e92e923283a89634ad17786762f72437ba460d790cd66e1b0a1e

  • SHA512

    add767c03b1fade0970c841d0a785fec202415e21809acfcfb973fbc2269837467ad3eb22a090d0af9a362edc1a1aa3033be58ff7a813e2403501ca01c9d7254

  • SSDEEP

    6144:2uWP/BtSnurUylcrGYlnIttxv8HbcLgsd1Gus5psdrvV44dixP+MHDkBYdxtG9+O:2uWP/BZUyoLu8Agsmxwrvejkd2

  Score

  10^/10

  rhadamanthysdiscoverystealer

  • Detect rhadamanthys stealer shellcode

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  behavioral1behavioral2