Check PointPublished
From Hidden Bee to Rhadamanthys – The Evolution of Custom Executable Formats
By etal
Excerpt
Research by: hasherezade
Highlights
Rhadamanthys stealer’s design and implementation significantly overlap with those of Hidden Bee coin miner. The similarity is apparent at many levels: custom executable formats, the use of similar virtual filesystems, identical paths to some of the components, reused functions, similar use of steganography, use of LUA scripts, and overall analogous design.
Check Point Research (CPR) highlights and provides a technical analysis of some of those similarities, with a special focus on the custom executable formats. We present details of RS, HS, and the latest XS executable formats used by this malware.
We…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on research.checkpoint.com.
Mentioned in the excerpt
More from Check Point88
- Gozi: The Malware with a Thousand FacesCheck Point · Published 28 Aug 2020
- Shattering the Dream - When a Job Offer Becomes a Zero-Day AttackCheck Point · Published 11 Aug
- Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution EcosystemCheck Point · Published 3 Jun
- Cavern Manticore: Exposing Iran-Linked Modular C2 FrameworkCheck Point · Published 6 Jul
