Severity
Medium
Analysis Summary
Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim's computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware's operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Theft
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
9e835b195b462eb8adca07d686440e7b
68ce1936d40722d372d69744a1e1866f
e84db67f8f30cd4ba03a0c9e6952628b
SHA-256
402c20125cc683ad940ebd9e4395cf53f0dc5308726ac0689bd831b2783f24cc
9d2eb97d89a1d979bf2a57aedf8c1ff77cd934895d890fc45686d547ca0faf11
5ca4552216ddc3b276e3cf2684cc5041b31931181a54d5cb62113bf6aaba1575
SHA1
c03bd7b00d733c961aff1b55b2d300932f0f35c2
284f9a91158c8796d1eb90094903bfb7e31889d9
c24c01cc464db661ec5f5910411b7049793fc1e6
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
- Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
- Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.