Severity
Medium
Analysis Summary
Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim's computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware's operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Theft
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
4e561e2dcfb22fede00a9612dd47b48d
4a12def90d42bae4be0ccc109c81f059
c88029157bc9f9e2c813c61823915db2
SHA-256
163a6b37201318865b962e4eb94c0043975862eacda9b00917c3fa61dc5c13e2
63e3d55e61542fb15706ad2f87551fecbb0c2b94e85e597a1f31eca54cfe2c4f
1133f41e2b463ce5024423dcad44bcc0ff9543c2d38eae5bddc6016da9f7a64d
SHA1
b7a15c2fc52d8b6ab3794a8a8c17171afdce6980
2e57b977abe14b730e6767b67f65f582c830e63d
43c331bd1f67d0ee7ba0cc9094baede93e15ab8a
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
- Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
- Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.