Extracted

• • Target
    rsDymE.vbs
  • Size 506KB
  • SHA256 8bed27f5b5a1f3fee9076396dfa556be72ce444e1b0bf1ee536d716939c3a974
  • MD5 7fba6758ee02d6fbd69db7bb5de82029
  • SHA1 7c759c4a7681da6e916d8dd80ecfb125f4bf49f5
  • SHA512 15c49c436bf5ed535f646f263e70e80f47de620a553a9f7a8a88482385eec5812970fdc0f69b915efa6006a58b16fbf47980f2fa34f54344cbe77ac28cc75722
  • SSDEEP 12288:0KaH9AkQqyuC+4MXBRNAIPyLKhaDw7JZJGjdbS4VZZ4Ph:89AkJyd+XXBzAIKOUU7Foxn4p
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  rhadamanthysdiscoveryexecutionstealer

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  behavioral1