Rhadamanthys Stealer is a MaaS-delivered infostealer that spreads via Google Ads and phishing sites impersonating legitimate apps, extracting browser data, crypto-wallet details, and system information. Cyble researchers describe its delivery chain from spam, to malicious installers, to a multi-stage loader and C2 exfiltration. #RhadamanthysStealer #GoogleAds #AnyDesk #Zoom #Cyble
Keypoints
- Rhadamanthys Stealer is deployed as MaaS and spreads through Google Ads directing users to phishing sites that mimic popular software (Zoom, AnyDesk, Notepad++, Bluestacks, etc.).
- Initial infection occurs via spam emails with a PDF attachment named “Statement.pdf.”
- Opening the attachment leads to a malicious installer that downloads a loader from a remote URL and executes the payload.
- The loader is a PyInstaller-based 32-bit executable that injects the payload into a Runtime Broker process.
- Anti-VM checks and obfuscated components are used to evade analysis (e.g., Binary_Stub_Replacer.pyc and rundll32 execution).
- The stealer targets crypto wallets and wallet extensions, browser data, FTP/email clients, VPNs, and messaging apps, and it captures screenshots for exfiltration.
- Exfiltrated data is sent to an attacker C2 panel; the campaign also relies on a C2/beacon communications structure.
MITRE Techniques
- [T1598] Spearphishing Attachment – “The Rhadamanthys stealer infection starts through spam emails containing a PDF attachment named “Statement.pdf”…”
- [T1204] User Execution – “When a user clicks the “Download Update” link, it downloads a malware executable from an URL …into the Downloads folder.”
- [T1059] Command and Scripting Interpreter – “The loader “Runtime Broker.exe” is a 32-bit PyInstaller executable…”
- [T1055] Process Injection – “The PE file is then injected into a new “Runtime Broker.exe” process using the CreateThread() API function.”
- [T1218] Rundll32 – “drops a DLL file named “nsis_unsibcfb0.dll” in the %temp% folder and launches it using the “rundll32.exe” with specific parameters…”
- [T1027] Obfuscated Files or Information – “The Binary_Stub_Replacer.pyc is a python compiled file which contains obfuscated raw data…”
- [T1497] Virtualization/Sandbox Evasion – “This check is designed to prevent the malware from being detected and analyzed in a virtual environment. If the malware detects that it is running in a controlled environment, it will terminate its execution.”
- [T1082] System Information Discovery – “The Rhadamanthys stealer now starts collecting system information by executing a series of Windows Management Instrumentation (WMI) queries. The collected information includes the computer name, username, OS version, RAM, CPU information, HWID, time zone, user and keyboard language, and others.”
- [T1083] Discovery File and Directory – “queries the directories of the installed browsers on the victim’s machine and searches for browser-related files such as browsing history, bookmarks, cookies, auto-fills, login credentials, etc.”
- [T1005] Data from Local System – “target the following crypto wallets… data from them” (and related browser data collection)
- [T1114] Email Collection – (listed in the article’s mapping as part of data targets including email clients)
- [T1071] Application Layer Protocol – “sends all the collected stolen information to the attacker’s C&C server” (C2 over application layer)
- [T1095] Non-Application Layer Protocol – (beacon/data exfiltration behavior implied by C2 activity)
- [T1105] Ingress Tool Transfer – (initial download of the loader/executable from a remote URL during infection)
Indicators of Compromise
- [Hash] context – 046981c818bd26e7c28b12b998847038e6b64c44df6645438dae689d75fb0269, 4f4b5407d607ee32e00477a9f4294600ca86b67729ff4053b95744433117fccf
- [Hash] context – 4a55c833abf08ecfe4fb3a7f40d34ae5aec5850bc2d79f977c8ee5e8a6f450d4
- [Hash] context – 093a58f36c075644d1dc8856acdefad7fd22332444b6aa07fee2ad615d50b743
- [Hash] context – db66fc58c07ba0ccbe1b9c2db770179d0d931e5bf73838da9c915581661d4c1a
- [Hash] context – fe99a49596fc6f841b7605021da6fce7f6c817d5247d880227f790388a7cabe4
- [URL] domain/URL – zolotayavitrina[.]com/Jan-statement[.]exe
- [File] context – Statement.pdf
- [File] context – AnyDesk.msi
- [File] context – Runtime Broker.exe
- [File] context – Shellcode exe
- [File] context – Binary_Stub_Replacer.pyc
- [Domain] context – bluestacks-install[.]com
- [Domain] context – zoomus-install[.]com
- [Domain] context – install-zoom[.]com
- [Domain] context – install-anydesk[.]com
- [Domain] context – install-anydeslk[.]com
- [Domain] context – zoom-meetings-install[.]com
- [Domain] context – zoom-meetings-download[.]com
- [Domain] context – anydleslk-download[.]com
- [Domain] context – zoomvideo-install[.]com
- [Domain] context – zoom-video-install[.]com
- [Domain] context – istaller-zoom[.]com
- [Domain] context – noteepad.hasankahrimanoglu[.]com[.]tr
Read more: https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/