Extracted

• • Target
    2026-03-08_69af30649d07c2bad8fbb2f2376789ab_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
  • Size 1.9MB
  • SHA256 7c5d3909c4c32061c3b69cbf11e6d936f30c478f9b06b49aca4162ec1fce50e2
  • MD5 69af30649d07c2bad8fbb2f2376789ab
  • SHA1 df2d83f2f50158a0d797426d8591b1a6b27b6b99
  • SHA512 5dbc9b34fbfa47026a10bce87ece5a40649bf39aec449f0cd43ab3546f844f40521a6c7f6a972accd8f03138b55f3c5059d09210a10f920f8fe902c220b42cc8
  • SSDEEP 49152:H3SF3DWhFU3AcOHYFv59oa1GOWJNg8ARSuSujF+N84A:H3SF3cVSOa1GvNDySbuEN8B
  • TLSH
    T1BF95357DA6360EB7D30F3635B7600309EB6968F405D12AE52A318C79EAC73CEB5D4A41
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderlgoogloaderrhadamanthysstealer

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Lgoogloader family

    lgoogloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detects Windows executables referencing non-Windows User-Agents

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2