Extracted

• • Target
    2026-03-07_52bbffed35bb88c1696662d00ec2978a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
  • Size 1.9MB
  • SHA256 0c3b4b6d9c2d878b6d2c501a6a51d5489da239ba40866929727c75d71ced6d42
  • MD5 52bbffed35bb88c1696662d00ec2978a
  • SHA1 b72846459c33b34da7a73601a51aa79e770336af
  • SHA512 3d0480ac45a52ae6ae277f47c666e7778cc009144beb3f4d079eb89839b70b7e24cfe643dc595d3d650cac58e71ab356967eb234d644412ca63739b88fade866
  • SSDEEP 24576:n6oZfKa9OEJ4J56LXaVBf8qFQ4HqiIYV+MfpU2tFD3c1eGDGVqk8ZVjrSOP+z:n6opKa9zdLXaVBf5dqir23DGckLO2z
  • TLSH
    T1D195E0116F40C4D7C0BFBB7979A13727686C65E0B3DBF33512A3589A0BB6A8445683B3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderlgoogloaderrhadamanthysstealer

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Lgoogloader family

    lgoogloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detects Windows executables referencing non-Windows User-Agents

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2