Extracted

• • Target

    output2.js

  • Size

    19KB

  • MD5

    7ad2fc01023899cc905e620961271150

  • SHA1

    7cd2e2d7086d59a3697c96ccfd705707ed2c3a87

  • SHA256

    b112d4db1d6ae3827653246c4f2b7413502ca1098ca2a1d00b6535b26ece0603

  • SHA512

    c710a96754e9b7a29c7113643bbb4b36012cc3a9d7491fc4b26a1059804c2e3f10039af7fdcdd1cc3a00768d515ed67855b805f45a83b130fb9c28a16f38769f

  • SSDEEP

    384:8R/vtrEGocUVdRtacNP8t1JaZHVI2+sRLlejNZdbjzn:uZEGon8t1CL8jlT

  Score

  10^/10

  discoveryexecutionrhadamanthysstealer

  • Detects Rhadamanthys payload

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2