May 15, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Reptile Rootkit: Targeted Attacks on Linux Systems in South Korea – Active IOCs
August 10, 2023Rewterz Threat Alert – STOP (DJVU) Ransomware – Active IOCs
August 14, 2023Rewterz Threat Alert – Reptile Rootkit: Targeted Attacks on Linux Systems in South Korea – Active IOCs
August 10, 2023Rewterz Threat Alert – STOP (DJVU) Ransomware – Active IOCs
August 14, 2023
Severity
Medium
Analysis Summary
Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim’s computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware’s operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Thefts
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
- ef059cc3e51dc54d34eb7b83679eedc1
- c8e60225448e9cda23b291b6b16bf78b
- 291aaeede8238ae450ffe6a23fe3a415
- 5d54c151407a7c421917b58b4a601a19
- 707ecee4f0002a210da19e0002fc8562
- 30b1cabb2920c8bc5e2452f859b19156
SHA-256
- 437b8f7b7d2020463314bb88b7de911c55c68d478c1abe51e37be891534ad096
- b71880c437249e1aae73ab4f9a2377e435ce8e13b8ca2ada12c2019428c50cc0
- 9a86c400c754a8a5d191bc77855f398dae45defb82c8821542b7ccd49370a179
- 03a6a15e8d8ca8d46a26826150fae2cf1d0e942d6e2905349c27bded38da0b7e
- 0043ce08603751d94a911c887c9fbd583a0914542daec18a75f2055588974d68
- 1cf8dee2b9563a6861c46ca56e9b79949ef48cc63bf2a9448bfe1b6f48681a92
SHA-1
- a75ef754c66d01b8ccb4a3303a2c7b8a02e5d0c9
- b4bf689c839ab7bf8bb337b66765580c0271c14d
- fd07dbcdb4b4fc03111e1d038130a93787879687
- 73420235c9257278ad0f0cf22a5faa920c5af20b
- b43cca0319370ee57f37f2bd82132436e39d8224
- aa7cda2663cfec324f21d30ccf20ec49573552ff
Remediation
- Exercise caution when receiving messages from unknown senders.
- Block all threat indicators at your respective controls.
- Keep your software updated to the latest patches.
- Search for IOCs in your environment.
