Check Point · Published 27 Mar
Rhadamanthys: The “Everything Bagel” Infostealer
By benhe
Excerpt
Key Takeaways
Rhadamanthys is an advanced infostealer which debuted on the dark web in September of last year to a warm critical reception by cybercriminals.
A maximalist approach to features: functionality is added for its own sake, never mind the effort required or expected payoff.
Campaigns by default target countries indiscriminately, excluding the commonwealth of independent states. This is typical of this kind of malware.
Multiple-stage loader/shellcode execution has been researched in prior publications and has made it difficult to reach a proper interactive disassembly work…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on research.checkpoint.com.
More from Check Point94
Check Point · Web page · Published 7 Mar
Pandas with a Soul: Chinese Espionage Attacks Against Southeast Asian Government Entities
In 2021, Check Point Research published a report on a previously undisclosed toolset used by Sharp Panda, a long-running Chinese cyber-espionage operation targeting Southeast Asian government entities. Since then, we have continued to track the use of these…
Check Point · Web page · Published 12 Jan
Going Rogue- a Mastermind behind Android Malware Returns with a New RAT
Research by: Aviran Hazum, Alex Shamshur, Raman Ladutska, Ohad Mana, Israel Wernik Introduction Now more than ever, we rely on our smartphones to keep in touch with our work, our families and the world around us. There are over 3.5 billion smartphone users…
Check Point · Web page · Published 10 Dec
Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits
Check Point Research (CPR) presents a full dissection of the widely used ValleyRAT backdoor, also known as Winos/Winos4.0, covering its modular architecture and plugin system. By analyzing the publicly leaked builder and development structure (Visual Studio…
Check Point · Web page · Published 10 Apr
Threat Actors Migrating to the Cloud
Where do malware payloads come from? It’s a question with an apparently trivial answer. Usually these sit on dedicated servers owned by the campaign managers, and occasionally on a legitimate website that has been broken into and commandeered. But, as we were…
On the same topics
Varonis · Web page · Published 22 Oct
StealC Is Back, and This Time It's a RAT
In June, Europol tore down StealC, a prominent infostealer, as part of Operation Endgame. International authorities seized 326 servers and 142 domains, recovered more than 25 million stolen credentials from 385,000 infected machines, and pulled the plug on…
ETDA Threat Group Cards · Web page · Added 25 Oct
Threat Group Cards: A Threat Actor Encyclopedia
Home > List all groups > List all tools > List all groups using tool Retefe (Android) Tool: Retefe (Android) Names Retefe (Android) Category Malware Type Banking trojan, Backdoor, Info stealer, Credential stealer, Botnet (GovCERT.ch) Recently, some anti-virus…
Gen Digital · Web page · Published 8 Oct
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data
Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in…
LevelBlue · Web page · Published 7 May
Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control Communication
LevelBlue’s Security Services issues Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them. In this Threat Analysis report, we…