Severity
Medium
Analysis Summary
Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim's computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware's operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Theft
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
043cb925e3ea2804f2851a00a68817a0
2e57d7d25136cb331e3a8d60a3ded01d
e24ebbea02f45e770d4c9707d0335678
fbd00613587981295e4a0f05feac4ff2
SHA-256
326e0aa4f12f9789037019d0d3f3fd8577b1f22a46f6cf4ca911024ed84fc70f
b84a86c351398876d92083d6d15e95e4f4972a3315cb162e16d08a2769f1d0cf
82285aaafe378305cd523e4bb1ad93725ba51501c7dcfc68af15512017115b9a
fa3e69c980d56f98f4e1c7f26488c5bc2dfc399f1d72b8a15efe4e09905b93d8
SHA1
20eb9e111e8a60c3f591a715223e131a5a19885b
a90d9c931dc7199d767f6828ee5e17cec5aaf932
14a2f0ad1e8f76fc8775bc495cf297198f33b6da
e2542de09b3b403c3d54c44df5d0a30bb85cb7ac
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
- Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
- Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.