Extracted

• • Target
    200ec79e0abd4b5009bc4108d3270830fc93d28fc03961053ea6c2ec998837c5
  • Size 2.7MB
  • SHA256 200ec79e0abd4b5009bc4108d3270830fc93d28fc03961053ea6c2ec998837c5
  • MD5 5000e2cfc33bc8302cc025a29e67c663
  • SHA1 9523ecd89296180091f458b0722c671cbb7877e4
  • SHA512 42c29bbb34c377a8c5df766b73cc5eecf8242bccc8ee47f53f12130b9445a19203c7c2118dde4d184a577e1eefcd925344c5d0c3b9c35f5d30e6afc5bf36b981
  • SSDEEP 49152:fKlYcfLLLIWpjLHUmACAkczzqcBrywk0dTTBX:fKWcfrXxH1AVDBmwfdT9
  • TLSH
    T116D59FEA06EC45DAF84FA7B85D724E278D94BFF48D350A0325C0D9DB494E9CA272C781
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderlgoogloaderrhadamanthysstealer

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Lgoogloader family

    lgoogloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2