Extracted

• • Target

    Firefox Installer.exe

  • Size

    364KB

  • MD5

    025551325e469abe4a751c806462b07e

  • SHA1

    4a3c205fa140a5b3ed0c969480287331209d818b

  • SHA256

    e46d78ad160f9ab85aac4246531fd3dd669006cddb8ed0dc23feec8b4621fb5b

  • SHA512

    cf9abb7c810535699fcbd395ce4bf7866290737f4af4a117b875304a18ce135baffccea3658fd6b5967de3bc48a38ec96e1f5049acc05ef27c3628fdb792ce53

  • SSDEEP

    6144:qaVWdyzOxeA1DfdwX3MmIO2NtxHjoRpFiX+piFDcCzJdAyzs5lSsZdpqkvfGE6wu:qMROxdDfOnMmXQthj+sJIGs5jZdcPTF

  Score

  10^/10

  rhadamanthysdiscoveryspywarestealerupx

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Legitimate hosting services abused for malware hosting/C2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1