Rewterz Threat Advisory – Multiple WordPress Plugin Vulnerabilities
May 29, 2023Rewterz Threat Advisory – Multiple WordPress Plugins Vulnerabilities
May 30, 2023Rewterz Threat Advisory – Multiple WordPress Plugin Vulnerabilities
May 29, 2023Rewterz Threat Advisory – Multiple WordPress Plugins Vulnerabilities
May 30, 2023Severity
Medium
Analysis Summary
Rhadamanthys is a type of malware known as a stealer, which is designed to steal sensitive information from infected computers. It was first identified in 2020 and has been active since then. The malware is spread through phishing emails and is designed to evade detection by antivirus software. Once installed on a victim’s computer, Rhadamanthys steals a variety of sensitive information, including passwords, browser cookies, cryptocurrency wallets, and files containing personal and financial information. The stolen data is then exfiltrated to a remote server controlled by the malware’s operators.
Rhadamanthys uses several techniques to evade detection and analysis, including encrypting its communications with the remote server, using anti-debugging and anti-VM techniques, and using steganography to hide its configuration files. The malware is highly customizable and can be adapted to target specific types of information or systems. It is also capable of downloading additional modules or payloads, which can be used to expand its capabilities or to carry out additional attacks.
Impact
- Credential Thefts
- Unauthorized Access
- Information Theft
Indicators of Compromise
MD5
- 076e8cfedfa31e546087a943e5e7c681
- 57dd320eae0fadd155619407c8b5313c
- fcec2cbdec0ef30831ad1c9ec5513d4c
- 8304fbd7fac97b91561c0d97b4ac115c
SHA-256
- 2aaae232c889912fe61abafb3dd36bfa3499d21daaf61d8c839ed53c50ffa388
- 4a524e63c81e6cf9ab8a86f8de0973ea6a6d0973545867d34eba1b777e238628
- 380c81695a2340dbaf8d0427188536d1eddfca4ee41a5aa7d23eb8a91d617c4c
- 75c9bc2333b79f852b933e147ffc12d95a30c85360d8d0a427bab27dc564a5de
SHA-1
- 19df36322342a4084ecf28606ad9372eb348fd3c
- fc2ce4b86d64025dbba19bb84e561a27fcb6ffb3
- efb3f8a76db7ed05327427ec1080e2cac40cac53
- a7bc0fac50a5ef3f593a2cfc3b20ccb107a192ad
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
- Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
- Emails from unknown senders should always be treated with caution.
- Never trust or open ” links and attachments received from unknown sources/senders.
- Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
- Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
- Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets