Rewterz Threat Advisory – CVE-2022-36060 – Node.js matrix-react-sdk module Vulnerability
April 3, 2023Rewterz Threat Advisory – CVE-2023-27346 – TP-Link AX1800 Vulnerability
April 4, 2023Rewterz Threat Advisory – CVE-2022-36060 – Node.js matrix-react-sdk module Vulnerability
April 3, 2023Rewterz Threat Advisory – CVE-2023-27346 – TP-Link AX1800 Vulnerability
April 4, 2023Severity
Medium
Analysis Summary
Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim’s computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware’s operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Thefts
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
- fd9277c7cb81691b9b997c4f2b0f9203
- 08c4a9c79753cae72dde469061b0f81f
- 2738ae4d00769e05e7dee2ce3a97e502
- eedb87d566f8cad1f24f753c6342b2c0
- 2cae0a3063fe5cb5d25f27bdf113b949
- 9d4291c61ddc47721f706dc8538ed04b
SHA-256
- 8404cb4a740d169256e49e3a22b2af1a61b2606e71cdca4f39deeccd5d461c91
- a19a2ccfc10090a33755dd12fc2f21192e5f7143605448187433fec059216af5
- 447102cbda0f30fdb352c94f4809d1301287bf232298760e7471dcfb718364ec
- 7435f660e40743693ff284299178d9bee52c9f9dbce2f1ca1bcc1f528ff47dc8
- dacf74a95c5167cba7660814b09ab8ee60b4d133a63182415c7040af39802d76
- 78805a8d4933d69af1e6b580bb082e2592fd0fa0e2042b926157f329d5483c53
SHA-1
- 84bf887ea4b5782996e43b6038df4572b579b45e
- a49fd04fe83c2b1d1476ee6b6419ed2c1f227d75
- 0656c139b158d62007c43b5bf53ea948ac99d5fd
- caf93fd32b3d4b114a0f2a0994aad81862d626dd
- 89f99f30de2af4f8379adabc240f59b1e32ceac5
- a0d20ab1de1e7ea8b560c8d2a6656ce108cc830c
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Emails from unknown senders should always be treated with caution.
- Never trust or open ” links and attachments received from unknown sources/senders.
- Maintain daily backups of all computer networks and servers.