Rhadamanthys Stealer v0.9.2 Drops: New PNG Payloads and Anti-Analysis Tricks Make Malware Deadlier

Rhadamanthys Stealer has released v0.9.2, introducing refreshed anti-analysis tricks, including a message box asking “Do you want to run a malware?” when executed in unpacked form. The update also uses PNG payload delivery, embedding next‑stage modules in noisy PNG files, a departure from the previous WAV/JPG loaders, according to Check Point Research.

The malware remains modular, with a redesigned configuration blob that begins with 0xBEEF markers and expands options such as multiple C2 addresses and new flags, and it continues to rely on its proprietary XS formats for modules. New capabilities include environment evasion through sandbox-detection checks of wallpaper hashes, usernames, and hardware IDs, as well as targeted process injection via a configurable list of Windows processes.

Extended Lua plugins add support for the Ledger Live crypto wallet, and a new browser fingerprinting module collects detailed telemetry from WebGL to installed fonts. The overall trajectory, as CPR notes, suggests an evolution towards a more professionalised, long‑term cybercrime enterprise rather than a mere tool.