Extracted

• • Target
    2026-04-03_945dbfb9cdc61af5536c86e6c36f9031_elex_icedid_njrat_stop
  • Size 2.0MB
  • SHA256 934681b40f60490d2cf7bdf49f5ec06c51f3b414afe8444175358d76269b2bcb
  • MD5 945dbfb9cdc61af5536c86e6c36f9031
  • SHA1 bd663aa1878a15660679bc39d9fcc6740d392a5a
  • SHA512 d911f3627de0fa191e2aa3f9ac37c008ebf68da9ca7b5533e895b01b48cdaa88671716e7017ac1f1100a83178cc519331f12f4450a7dc39b3753de9bb05d79bc
  • SSDEEP 49152:YQe8eWQUtlTsdSJvf6ef+ieCwhWmQZyPT7:2YrTsdcf6BieCq9QZyn
  • TLSH
    T1A7A5CF1662C057FBC2220E325E1682D18327BC0B7ED2576A3AA4136E4E6E7CDFF15B15
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderlgoogloaderrhadamanthysstealer

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Lgoogloader family

    lgoogloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detects Windows executables referencing non-Windows User-Agents

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2