Severity
Medium
Analysis Summary
Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim's computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware's operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Theft
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
72ec64d0bc0b31f8842c9b5d488c11e7
e255c745717b00f238c5b41aa2196153
ad290b652fa45465b8b87fe80de65a30
f8cd8cd3e6a25d340c068d8afc584d57
SHA-256
019e368cdfe9e71959dfc32917463653dfa4c35c129f1feb1fe492187d46a22a
47dc344e945a0170c1f69caf1cf5d63bca22239e17f7df1a01e6235484fa0593
940d0e9a9879f1454432a8a11a4f34d2f632b0229067a7a5d3371d315af0d752
285557d7846b75b624cb60db673bceb9a7093330476875499e062aa18b39e4bb
SHA1
85d81edeac18c67d6c8b73ab628347586a5039ad
4aea97c6ecbd3de68791cc2591c930965962d6e7
169f51bef8092c6ca211e97de741c61cd5961345
a2df305f1715f4edb3475ded16b5ce7fd1d07a49
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
- Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
- Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.