Rewterz Threat Alert – Rhadamanthys Stealer

Rewterz Threat Advisory – CVE-2022-36060 – Node.js matrix-react-sdk module Vulnerability

April 3, 2023

Rewterz Threat Advisory – CVE-2023-27346 – TP-Link AX1800 Vulnerability

April 4, 2023

Rewterz Threat Alert – Rhadamanthys Stealer – Active IOCs

Severity

Medium

Analysis Summary

Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim’s computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware’s operators.

Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.

Impact

Credential Thefts
Unauthorized Access
Information Theft

Indicators of Compromise

MD5

fd9277c7cb81691b9b997c4f2b0f9203
08c4a9c79753cae72dde469061b0f81f
2738ae4d00769e05e7dee2ce3a97e502
eedb87d566f8cad1f24f753c6342b2c0
2cae0a3063fe5cb5d25f27bdf113b949
9d4291c61ddc47721f706dc8538ed04b

SHA-256

8404cb4a740d169256e49e3a22b2af1a61b2606e71cdca4f39deeccd5d461c91
a19a2ccfc10090a33755dd12fc2f21192e5f7143605448187433fec059216af5
447102cbda0f30fdb352c94f4809d1301287bf232298760e7471dcfb718364ec
7435f660e40743693ff284299178d9bee52c9f9dbce2f1ca1bcc1f528ff47dc8
dacf74a95c5167cba7660814b09ab8ee60b4d133a63182415c7040af39802d76
78805a8d4933d69af1e6b580bb082e2592fd0fa0e2042b926157f329d5483c53

SHA-1

84bf887ea4b5782996e43b6038df4572b579b45e
a49fd04fe83c2b1d1476ee6b6419ed2c1f227d75
0656c139b158d62007c43b5bf53ea948ac99d5fd
caf93fd32b3d4b114a0f2a0994aad81862d626dd
89f99f30de2af4f8379adabc240f59b1e32ceac5
a0d20ab1de1e7ea8b560c8d2a6656ce108cc830c

Remediation

Block all threat indicators at your respective controls.
Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
Emails from unknown senders should always be treated with caution.
Never trust or open ” links and attachments received from unknown sources/senders.
Maintain daily backups of all computer networks and servers.