Extracted

• • Target

    Anubis.exe

  • Size

    1.2MB

  • MD5

    c2adb7ff42f1c961035f17bad5bee12d

  • SHA1

    e2ae36539f9ff88e8a89d750e99d15ea6e84f0dc

  • SHA256

    4b350ae0b85aa7f7818e37e3f02397cd3667af8d62eb3132fb3297bd96a0abe2

  • SHA512

    16413f90689cfa3fc509637bea54634ead1bba7f89d621bbc8096279f2413cd3477142a63becfa457e5756583c34049699ab1e960d1133dad2f72e3325ecb348

  • SSDEEP

    24576:uDDgbYd14JwD00GR/L4Sgh5ovGpuIGPBgyjhgQJ8L/inWS:gcbILXoO3p9GP6ydk/inWS

  Score

  10^/10

  rhadamanthysdefense_evasiondiscoverystealer

  • Detect rhadamanthys stealer shellcode

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2