Extracted

• • Target

    6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630.exe

  • Size

    13.8MB

  • MD5

    371e947f5d28b083c86a5db933d392a0

  • SHA1

    0855077258e3377f4af707ab0e33818799187234

  • SHA256

    6a45de9005c3af696b8b4e9493b51ffdd7fe815acdd9dc3afc52401f612ae630

  • SHA512

    9fafbaecdbdff56484e189fcec575e2a23c38b8054ed5d8206982b9b8650f5bbec2990e710a29a1134a53c060a2c2cd85b3fba6fac718c5bb213a7cea9403184

  • SSDEEP

    393216:cSXdOirfXtcAxWCigfnjhxqFEzHVNuXvufFJi0+0mxIMLvVFJeEMQbJAQdZ:cyLrfXtZxWLAjPqGzVNGu6xPSmVFJDMa

  Score

  10^/10

  rhadamanthysdiscoveryevasionexecutionpersistencestealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2