Severity
Medium
Analysis Summary
Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim's computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware's operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Theft
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
f7c96de2605825b44d518b46f0b1a66a
3ecdff159b680724f0085b9d88e44d06
151420053d2b791b8f6c229d3b0b2de2
SHA-256
9e45fd04c07ce49dfc338a00b9254bf4e5bff656f2128f4231d171042e8c81d5
40c6f87cc45b30f1681cebf3b46022a4c06d82d4cb12efcaac65ef3bacb27aec
c4dcbf6a2675b073dc875d9becb72569e191840fbe63a473949d4d91ffff63ce
SHA1
10fd159d77cb69f8ea792d04ec68e87a9d1b03fb
ae03a3839b70aefb11df4bdd93623c6c087d0796
db3afcf92245f980e5e23eb9290f0508728d0087
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
- Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
- Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.