Extracted

• • Target
    2026-04-08_9faa3967ae9d8980981b11e5d932883d_elex_redline-stealer_rhadamanthys_stealc_stop
  • Size 5.1MB
  • SHA256 deb1866aa591b885997ecd547689add71e59380c627e707fcbd730e48691a2c8
  • MD5 9faa3967ae9d8980981b11e5d932883d
  • SHA1 138872ad693be4444d97e4edfe56d0f9d24e85ee
  • SHA512 59ed884d7285e51b542c491c8ac05a586833dfc22331eb841e7cee0c396253b8c4420a7c994f246e876507aaa506e50843f4bd90dbb3fee1505183ef11e6b517
  • SSDEEP 98304:KdFwHQR3l8sa3HlTKPGmrI2TpY8g26sTYlt4b8nWPo:KrR7a3lTKualK8g2/Tm4no
  • TLSH
    T1D936522FF6CC639BDB883979C981D3802877F4BC1A54753E487EB0A6891DE028EB5355
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryprivateloaderrhadamanthysloaderstealer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Privateloader family

    privateloader

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Rhadamanthys family

    rhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2