Severity
Medium
Analysis Summary
Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim's computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware's operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Theft
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
f0f113f233146192c241e1bb474bc3bc
135cf45d92edac6e479147b51a40a065
88796c2e726272bbd7fd7b96d78d1d98
337ca68d95b56dc66c88a83874469be0
SHA-256
65663a30c4989ed3254f1effccb3ed3de8ab395bfb1f207ea8d82c8ebda9636f
209d8d6b69d558c40cc5a9152967deb3a9797793651e5193d2f19c233da863d0
85fa677d5892fe5c794eb9d0e51dd317b8d898e97c49a9a1c4875417c0147556
f324e86c471fa1726c0e977d76dbf69083115770ae563d0817861008ca3a908d
SHA1
91bba733d3995e9bb54cf198a85686e4bfc89aec
e44bec224c21df4993c4bb5387faadddd4be87ee
b359918e124eda58af102bb1565c52a32613c656
08dcbbd8f62209e5a2d08fbf770d1f2cbfd05292
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
- Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
- Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.