Severity
Medium
Analysis Summary
Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim's computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware's operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Theft
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
4d1ac46bc28e11b9b76e129d708a5781
7e09304f0ebb95afca50e852e7adb9bf
692e81c8e3ff8907b0c7418b5b2a40e6
SHA-256
a3660ead1822c67bd10651ede8654d3748c60d4f09cebe3e233b50238575b2fa
ea151b7d75a4e24c510fb4f007f52e08ceb9282e77e8968be98d363cafb5e124
3c1d0f917fc9f6849b574b45298c32369290f615c319e48fb2a7c6cffb54ccf0
SHA1
b8e922806203b30943a6bddcf3b0f0399696e2ac
ef9e08bc9f47241e7dea54a8b67b81f818bcbf16
6c5c6a74fcc32ee66084dab5c6723256844890c2
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
- Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
- Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.