Extracted

• • Target

    JaffaCakes118_689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677

  • Size

    704.8MB

  • MD5

    9cfe63d830e6f3821ffd5df71a76b268

  • SHA1

    a267e0305fa9a90a0b3461ab4c002eace9bf9cb2

  • SHA256

    689c458a2eff97ed8bda994d4eb86bf4fb9d85fae59557fe2ef1f6b60963d677

  • SHA512

    8bd5cbf130f117d5c8b812206fb84f61d9adf7ea6e0871f091535348203939deb7746416d1d5b30206e73e8409705644d9914ba38e156f68aa4653da14ca9dc9

  • SSDEEP

    49152:yfLu6Wexov67DXJJipU1FGDH8F9ClBX51aqBz0H/wBuLEpqd06GzZ1+WOg/m:ai6Txoi7DmpUOD87qXXWfwB6EpqHG8

  Score

  10^/10

  rhadamanthysdiscoverystealer

  • Detect rhadamanthys stealer shellcode

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2