Loading malware…
Rhadamanthys is a Windows information-stealing malware family written in C++ that has been active since late 2022 and is commonly offered through malware-as-a-service subscription models. It is used to collect and exfiltrate sensitive data from infected systems, including browser credentials and cookies, system information, cryptocurrency wallet data, and information from a broad range of desktop applications such as password managers, VPN clients, FTP clients, messaging platforms, email clients, gaming platforms, and file-transfer tools. Reported targeting includes cryptocurrency-focused victims, business users, and enterprise environments where follow-on compromise can enable broader intrusion activity.
Rhadamanthys is distributed through multiple criminal delivery channels, including phishing and malspam, malicious online advertisements, fake software installers and updates, cracked or pirated software, drive-by and loader-based infection chains, and deceptive landing pages that impersonate legitimate software brands. It has also been observed as a final payload delivered by other malware and access services, including Dolphin Loader, GHOSTPULSE, TA866-associated chains, and broader stealer-traffer ecosystems.
Technically, Rhadamanthys commonly uses staged execution and strong defense-evasion tradecraft. Documented samples include packed droppers, in-memory shellcode decryption and execution, callback-based shellcode launch, anti-VM and anti-analysis checks, suppression of error dialogs, mutex masquerading, dynamic API resolution, and user-mode unhooking or inspection of security-related modules. Some observed chains use AutoIt intermediates, DLL execution via rundll32, and process injection to launch or protect the final stealer. The malware communicates with command-and-control infrastructure to transmit stolen data and can receive additional tasking or payloads.
Rhadamanthys has been associated with financially motivated cybercrime operations and has appeared in campaigns linked to malvertising crews, traffer teams, and threat actors such as TA866. It has also been used alongside other commodity stealers and loaders including Lumma, Vidar, StealC, RedLine, SectopRAT, DarkGate, and NetSupport. Its prevalence made it one of the more prominent infostealer services in 2025 before major law-enforcement disruption efforts, including Operation Endgame, targeted infrastructure associated with the malware.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Threat Details and IOCs Malware: ... Rhadamanthys ...
13 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It is claimed that the Rhadamanthys Stealer is used and a loader for Traffers is provided.
Rhadamanthys is an information stealer that can be used to collect and exfiltrate a variety of sensitive data from infected systems.
This PowerShell script ran Rhadamanthys malware. Rhadamanthys was then observed to download and run zgRAT.
Deploy advanced endpoint detection and response (EDR) solutions to monitor for and block the execution of known malware families associated with Crazy Evil, such as Rhadamanthys, Stealc, and AMOS.
It also recently added a commercial infostealer - Rhadamanthys - sold on cybercrime forums to its arsenal, according to Check Point.
Rhadamanthys is a prominent malware observed since 2022, used by multiple cybercriminal threat actors. It is a modular information stealer with multiple pricing plans, and the creators sell it alongside Elysium Proxy Bot and a Crypt Service.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Sharing malicious code or phishing panels via YouTube : They promote popular apps or cracked versions of apps as free downloads, and include download links or panels in the video description to entice users to download the malicious code.
The script retrieves a ZIP archive ... extracts the content of the archive (an AutoIt executable and the malicious script name script.a3x) under the %TEMP% folder and executes an AutoIt file.
We’ve been observing an initial access technique that tricks users into copying, pasting, and executing malicious PowerShell code... users are presented with the typical Verify You Are Human prompt... Clicking the button silently copies an obfuscated PowerShell command to the clipboard and presents the user with “Verification Steps” instructing them to: Press Windows Button + R... Press CTRL + V... Press Enter. | One technique we’ve recently seen lead to LummaC2 involves tricking users into copying a PowerShell script from a pop-up message, pasting it into the Windows Run dialogue box, and executing malicious PowerShell code.
These messages contained URLs leading to a download of a JavaScript file hosted on Microsoft Azure. The JavaScript called PowerShell to run a remote PowerShell script.
The shellcode execution will go as the following: The function sub_405728 is responsible to invoke the API call ImmEnumInputContext... ImmEnumInputContext will get the address of the shellcode in its second argument “lpfn” and will execute it.
it is just a small shellcode that unpacks and inject into the memory the Rhadamanthys stealer itself. | a call to VirtualAlloc will happen to create a newly allocated memory followed by memcpy to copy the shellcode from the heap to the new memory. Lastly, a VirtualProtect API call will be used to change the permission of the memory segment to RWX. | This function access the Process Environment Block to get the address of Kernel32.dll. This behavior is traditional and happens in many shellcodes. | After having a shellcode with EXECUTE permission, we need a way to execute it, in this case, the authors choose a cool trick in form of a Callback function.
This function access the Process Environment Block to get the address of Kernel32.dll... it iterates through the kernel32 export functions... hash the function name... Overall the functions will be “VirtualAlloc, LocalFree, LocalAlloc, VirtualFree”
They promote popular apps or cracked versions of apps as free downloads... Operate fake casinos or gambling sites through phishing panels that replicate the UI of legitimate casino sites.
it is just a small shellcode that unpacks and inject into the memory the Rhadamanthys stealer itself. | a call to VirtualAlloc will happen to create a newly allocated memory followed by memcpy to copy the shellcode from the heap to the new memory. Lastly, a VirtualProtect API call will be used to change the permission of the memory segment to RWX. | This function access the Process Environment Block to get the address of Kernel32.dll. This behavior is traditional and happens in many shellcodes. | After having a shellcode with EXECUTE permission, we need a way to execute it, in this case, the authors choose a cool trick in form of a Callback function.
The config decryption occurs in a function named sub_3DD4... sub_28AA This function is basically just an RC4 algorithm
An encoded PowerShell command then leverages Microsoft HTML Application Host (mshta.exe) to download and execute a malicious payload from a remote resource... Detection opportunity: mshta.exe utility making external network connections.
The malware collects information from the discord directories, possibly to extract further data.
A stealer is malicious code that steals account information, passwords, financial data, and other sensitive personal information stored on a system.
the loader gets the address of KiUserExceptionDispatcher and starts to iterate on it to search for a specific location where ZwQueryInformationProcess is called... the call was replaced to jump to a function in the loader
the same function appears to aim for the AVAST-related modules aswhook.dll & aswAMSI.dll... More amsi-related functions and DLLs that are being targeted by the stealer are: avamsicli.dll amsi.dll AmsiScanString AmsiScanBuffer EtwEventWrite | the loader gets a handle to ntdll.dll and loads it to virtual memory... They will be compared using memcmp, and if they will found different, the loader will change the protection of the real function of ntdll and will use memcpy to copy the data from the fake to the real one.
292 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
178 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rhadamanthys3
The disruption is the latest phase of Operation Endgame, which previously disrupted other malware families, such as DanaBot, Bumblebee, Rhadamanthys, VenomRAT, Elysium, and SmokeLoader.
An active infostealer service identified as one of the more prevalent offerings in 2025.
Rhadamanthys is identified as an active infostealer service and one of the most prevalent infostealers in 2025.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.