Severity
High
Analysis Summary
active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim’s computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware’s operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Thefts
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
- eba48fdbd88c0909cb8bddda6d20f597
- 4b6cc351bebafc5a8dfc4ea4aa59fa4b
- 323317d95d40108aa42de6bff8ee8bbd
- bca1f5ea6b1712923c3534bd67ca2d29
- 58010a1b6bc687458700c7e2e663fb79
- ba4b9530c664a0b57b572cc22ac996e6
SHA-256
- ebc9f697284097979e511887e40f9e1bc57fcedb2be1f37fb1ed20ee90004d93
- 37e0b7e14eaeeb2205c87261982e272eaa6dd4b95fdd2edc7b2a5b9d29b64a09
- 695ebf4db6a46967bdecfe41ea5db0b2f96845a460f7d16eb2fcd3111f2dd36c
- 97fbb8c62444ab8fef4af17c33117b43c9f926a45445ecc9fc51138089a75000
- bcc6c5ebaa7ede4e4485cc0a1884e6e12923e4c7aca85283b2a546c2b8034055
- 0f13412e34d79c5c24595dbf76c44ded557d8bf22bc420802e7843cc84ef7ded
SHA-1
- 8a492a14d84dc032aa6d1b9b5ea06a9650d85052
- 104aaf3125ada0828f23a4424a11b6f0699bd9d5
- 6e6f135129f9fa143e193970cafadf19ae4cd28d
- 07ece5ce3c1cef86f7db7ba7333c595122919ff5
- 50cad0117a9b13d530fb4861170c48ac0a2c671d
- eb40b07b928a80627cffa1e5605f7015911b4c1a
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
- Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
- Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.