Severity
Medium
Analysis Summary
Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim’s computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware’s operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Thefts
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
- c9945320750afb763a0757b355411bb7
- e679d0b0c4fd022ec9c8f4bed846ea73
- 224a575de77c4d9f340848239adb20ec
- 698ce2cd655de784d4c2d82f075bad56
- b8ebb22a2dfda2427e4982b26ff59565
- e6bb39c8b5f2bf35a4213c07af2b6ad1
SHA-256
- c7bdb994f4d0f5870c0e4338d6bf623ea78d2124be96a644314048f6d8510581
- cae67eb55f0571eb6bc40533a40b5ed6e8e4fc4a7a6f8312f5550e287436f597
- e40c3dd832634b0847f84a4499047d9552a77a62245a99ccec4b084c948188c6
- e4e4d31befd74c000d49c480916ac805be52fc604b9dcb4f7ca7590fce972be6
- 2c7965dc79af4e1e3a668c8b333344152f7934b663f7d064185a87e7581ca64e
- b3a6f50e51244a96d86fb775786192c76aa147ec7cdb10f721d7785924434909
SHA-1
- 9d5e454ff7b750cc8b2f272e5d8ce128b4573cb3
- 36242ba23e79daa0934bb01cc9cd59e5655abd04
- db737d7f9dc6a6e8b3ed78ce1d7cfe1c3fe752ea
- 6cf612fc152cdad59caac07bb73db943e4bf0cdc
- 47fd5a2923558a0a46af3e3c63235c462901d2fa
- c7de07005e651959592a8921d5a015e452d85568
Remediation
- Block all threat indicators at your respective controls. Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Enable two-factor authentication (2FA) on your accounts adds an extra layer of security and can help prevent unauthorized access even if your login credentials have been stolen.
- Regularly backing up your important data can help ensure that you don’t lose any critical information in the event of a malware infection or other data loss event.
- Be wary of emails, attachments, and links from unknown sources. Also, avoid downloading software from untrusted sources or clicking on suspicious ads or pop-ups.
- Make sure all of your software, including your operating system and applications, are up-to-date with the latest security patches. This can help prevent vulnerabilities that could be exploited by Aurora Stealer and other types of malware.