Extracted

• • Target

    runner.ps1

  • Size

    276KB

  • MD5

    e255c745717b00f238c5b41aa2196153

  • SHA1

    4aea97c6ecbd3de68791cc2591c930965962d6e7

  • SHA256

    47dc344e945a0170c1f69caf1cf5d63bca22239e17f7df1a01e6235484fa0593

  • SHA512

    7e155e523a895bf2bd97ba41316c674a828948c3d6ee7f49c2b2342188d76c53a29bef819a4ec3533106f841b021153ec9f18cfd2f2db6fd01d1d15d06e5468d

  • SSDEEP

    1536:iQEjSvrxQrgoc7I5eFgk7OQdjdlYG76p/zIOO5Ys:O2vtQrO7I5eFgk7OQd0g6p/NO5Ys

  Score

  10^/10

  executionrhadamanthysdiscoverystealer

  • Detects Rhadamanthys payload

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2