Extracted

• • Target
    2026-04-04_b9840936bc4d579f5771e628123d35a1_amadey_elex_glassworm_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
  • Size 3.7MB
  • SHA256 4fc28fbc0d0c602f985b2c0fbdbffff3c887acf6cad2638a6acae7e859057dcc
  • MD5 b9840936bc4d579f5771e628123d35a1
  • SHA1 09c39f1b859af065d94725c5fb07b547326d5fd4
  • SHA512 f6747af9c3caf21519d47546b0fc6c11a39992425797466124fc46c1a50be727077e972dad36a97a7b0c11696a1a22bbf77959d8f4f9caca4f6510c6a2709665
  • SSDEEP 49152:t6opKa9zdLXaVBf5dqir23DGckLO22VmgbQIzZMPXpU:t64xdLdw23DGBOWO
  • TLSH
    T1B9060613EB4189D6D3AF6636EE54A210971DF15967FBA330341801C8DF63386BF61B2A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderlgoogloaderrhadamanthysstealer

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Lgoogloader family

    lgoogloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detects Windows executables referencing non-Windows User-Agents

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2