Rhadamanthys 0.9.x – walk through the updates

Rhadamanthys 0.9.x introduces a range of sizeable updates, with 0.9.2 already gaining traction and affecting defenders’ tooling. The XS1 and XS2 custom formats received changes: XS1_B adds a new imp_key byte and XS2_B extends the import structure so the DLL name field uses DWORD, reflecting a continued churn designed to slow analysis.

The initial Stage 2 core checks were updated, including removal of the SibCode registry key, and mutex handling now employs a 16‑byte seed to generate mutex names, altering how injection trees are detected. A new configuration format begins with a 0xBEEF marker (instead of RHY!), with layered deobfuscation and LZO decompression, and the config is capable of carrying multiple C2 URLs.

The attack chain now fetches modules by checksums, decrypts them in memory, and uses a broader, configurable list of injection targets, plus a PNG-based delivery mechanism for Stage 3 payloads. According to Check Point Research, these evolutions—along with a new bot‑ID generation method tying the ID to a machine GUID and volume serial number hashed with SHA‑1—signal a maturing yet still flexible threat that defenders should monitor closely.