Extracted

• • Target
    2026-03-24_1c4673cdf67fd77d645d6dcd33451fed_amadey_elex_rhadamanthys_smoke-loader_stop
  • Size 3.4MB
  • SHA256 98d736048fb81fbcbec658bef625038ad3bce8bb126f0765f3b69dcfbf6c2374
  • MD5 1c4673cdf67fd77d645d6dcd33451fed
  • SHA1 66fa9b06441b870a8296cf9a8fa112363b482a1f
  • SHA512 1dec32a6be8d37b828dab43532e6a3c2f35ccd92356192d9246053cae472802f69b782f286a5fc38e0f954757c551c64a3df22cc0067932077183a70d8c898b3
  • SSDEEP 49152:r6yUWOvfW2charw0aRPFGnUgkBeS6Ll6jf:r6yUWufW2PrwJnGUgkwS+2f
  • TLSH
    T108F54AB515D818DAE49A273C25B33B2B8D80BF74447A653128C8A9CFAE4DDD7075C3B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderlgoogloaderrhadamanthysstealer

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Lgoogloader family

    lgoogloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2