Stealc Information Stealer Malware – Active IOCs
July 18, 2025Multiple Microsoft Windows Products Vulnerabilities
July 18, 2025Stealc Information Stealer Malware – Active IOCs
July 18, 2025Multiple Microsoft Windows Products Vulnerabilities
July 18, 2025Severity
Medium
Analysis Summary
Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim's computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware's operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Theft
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
a1fa412d9adc91a995ab2adf6ed3819a
c912281e70d8a6409381fd471a0eb26e
428a1c37e49be8dbcc859ad7e9e923d5
SHA-256
245b3b7ca1ee7d7ba2849248c9004dd0cb8da157c47dfc913a33213586f37c0a
519828fe5bc9b74a60e38d22b693958b4ce7b10f351ea32adda5e77c8ed8d4b3
e4e654d5ce9fb5d329f9ad187628be00900d04fe508547017142d54b2e58535f
SHA1
8a1238f4f8552c20b4274efb40edc1da65131405
744c0880baea7025f19e876d217ae8dc9f0de072
651a431e2e5c45046788802d4dc620ec4ae6cb32
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
- Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
- Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.