Extracted

• • Target
    a6773eebea2d665120543f21a39b9994c54b473e1c8810376590557ef9af689d.exe
  • Size 3.3MB
  • SHA256 a6773eebea2d665120543f21a39b9994c54b473e1c8810376590557ef9af689d
  • MD5 e24de9658bafd3809385636932607d23
  • SHA1 7060fbd6ac6b79fa5fa6b851156b10699afa1b87
  • SHA512 d4202fb6c7efd230472bcd7ed79c5aa43ee66415e942d238350fcf584350fc4158f4051486540bab2e3e08a94baf10ccfafa1d3b1758c3ada46365d284d70020
  • SSDEEP 49152:D6yUWOvfW2charw0aRPFGnUgkBeS6Ll6jBVmgbQIzZMPXpB91rHpE:D6yUWufW2PrwJnGUgkwS+2gnLrHpE
  • TLSH
    T1A8F5BE5BDB929AE8F68D14765B680154EB1EF625B25F2360349C024CCF873878FA5E3C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderlgoogloaderrhadamanthysstealer

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Lgoogloader family

    lgoogloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2