Loading malware…
Rhadamanthys is a modular Windows information-stealing malware family written in C++ and operated as a malware-as-a-service offering since late 2022. It is one of the more prominent infostealers in the criminal ecosystem and has been distributed through multiple lure and delivery chains, including fake software installers, malicious advertising, cracked software, malicious attachments, and loader-mediated infections. Observed campaigns have also delivered Rhadamanthys through intermediary loaders and scripted chains that unpack and execute the stealer in memory or via staged payloads.
Its core function is theft of sensitive user and system data. Rhadamanthys is known to target browser-stored credentials, active session cookies, autofill data, and a broad range of application data from communication tools, email clients, file-transfer software, VPN clients, password managers, gaming platforms, and cryptocurrency wallet software and services. This makes it useful for account takeover, financial theft, follow-on intrusion enablement, and resale of stolen logs in underground markets.
Technical reporting describes a multi-stage infection chain with strong emphasis on defense evasion. Samples have used packed droppers, shellcode-based staging, callback-based execution, dynamic API resolution, anti-VM and anti-analysis checks, exception-handling manipulation, suppression of error dialogs, mutex masquerading, and restoration of hooked user-mode API bytes in common Windows libraries. Some observed chains download and execute additional DLL payloads, showing that Rhadamanthys can be deployed through loader architectures and can participate in broader post-compromise workflows.
Rhadamanthys is closely associated with the cybercrime infostealer ecosystem rather than a single state actor. It has appeared alongside other commodity malware families and loaders such as Lumma, StealC, Vidar, DarkGate, Dolphin Loader, QuirkyLoader, and Snake Keylogger in criminal distribution operations. Law-enforcement actions under Operation Endgame disrupted parts of its infrastructure in late 2025, but the family remained a widely recognized infostealer brand in subsequent reporting.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Threat Details and IOCs Malware: ... Rhadamanthys ...
13 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It is claimed that the Rhadamanthys Stealer is used and a loader for Traffers is provided.
Rhadamanthys is an information stealer that can be used to collect and exfiltrate a variety of sensitive data from infected systems.
This PowerShell script ran Rhadamanthys malware. Rhadamanthys was then observed to download and run zgRAT.
Deploy advanced endpoint detection and response (EDR) solutions to monitor for and block the execution of known malware families associated with Crazy Evil, such as Rhadamanthys, Stealc, and AMOS.
It also recently added a commercial infostealer - Rhadamanthys - sold on cybercrime forums to its arsenal, according to Check Point.
Rhadamanthys is a prominent malware observed since 2022, used by multiple cybercriminal threat actors. It is a modular information stealer with multiple pricing plans, and the creators sell it alongside Elysium Proxy Bot and a Crypt Service.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
The script retrieves a ZIP archive ... extracts the content of the archive (an AutoIt executable and the malicious script name script.a3x) under the %TEMP% folder and executes an AutoIt file.
We’ve been observing an initial access technique that tricks users into copying, pasting, and executing malicious PowerShell code... users are presented with the typical Verify You Are Human prompt... Clicking the button silently copies an obfuscated PowerShell command to the clipboard and presents the user with “Verification Steps” instructing them to: Press Windows Button + R... Press CTRL + V... Press Enter. | One technique we’ve recently seen lead to LummaC2 involves tricking users into copying a PowerShell script from a pop-up message, pasting it into the Windows Run dialogue box, and executing malicious PowerShell code.
it is just a small shellcode that unpacks and inject into the memory the Rhadamanthys stealer itself. | a call to VirtualAlloc will happen to create a newly allocated memory followed by memcpy to copy the shellcode from the heap to the new memory. Lastly, a VirtualProtect API call will be used to change the permission of the memory segment to RWX. | This function access the Process Environment Block to get the address of Kernel32.dll. This behavior is traditional and happens in many shellcodes. | After having a shellcode with EXECUTE permission, we need a way to execute it, in this case, the authors choose a cool trick in form of a Callback function.
This function access the Process Environment Block to get the address of Kernel32.dll... it iterates through the kernel32 export functions... hash the function name... Overall the functions will be “VirtualAlloc, LocalFree, LocalAlloc, VirtualFree”
They promote popular apps or cracked versions of apps as free downloads... Operate fake casinos or gambling sites through phishing panels that replicate the UI of legitimate casino sites.
it is just a small shellcode that unpacks and inject into the memory the Rhadamanthys stealer itself. | a call to VirtualAlloc will happen to create a newly allocated memory followed by memcpy to copy the shellcode from the heap to the new memory. Lastly, a VirtualProtect API call will be used to change the permission of the memory segment to RWX. | This function access the Process Environment Block to get the address of Kernel32.dll. This behavior is traditional and happens in many shellcodes. | After having a shellcode with EXECUTE permission, we need a way to execute it, in this case, the authors choose a cool trick in form of a Callback function.
The config decryption occurs in a function named sub_3DD4... sub_28AA This function is basically just an RC4 algorithm
An encoded PowerShell command then leverages Microsoft HTML Application Host (mshta.exe) to download and execute a malicious payload from a remote resource... Detection opportunity: mshta.exe utility making external network connections.
Rhadamanthys exfiltre des données sensibles telles que des identifiants et des portefeuilles de cryptomonnaies
The malware collects information from the discord directories, possibly to extract further data.
ce malware permet aussi d’exfiltrer l’historique du navigateur, des captures d’écran et d’autres informations générales sur le système de la machine victime
A stealer is malicious code that steals account information, passwords, financial data, and other sensitive personal information stored on a system.
The malware target sensitive registry keys of the WinSCP in order to collect information.
Rhadamanthys targets a broad range of sensitive information, including credentials from browsers, system information, cookies, cryptocurrency wallets, and application data.
the loader gets the address of KiUserExceptionDispatcher and starts to iterate on it to search for a specific location where ZwQueryInformationProcess is called... the call was replaced to jump to a function in the loader
the same function appears to aim for the AVAST-related modules aswhook.dll & aswAMSI.dll... More amsi-related functions and DLLs that are being targeted by the stealer are: avamsicli.dll amsi.dll AmsiScanString AmsiScanBuffer EtwEventWrite | the loader gets a handle to ntdll.dll and loads it to virtual memory... They will be compared using memcmp, and if they will found different, the loader will change the protection of the real function of ntdll and will use memcpy to copy the data from the fake to the real one.
1,118 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
183 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware discussed in a malware analysis entry focused on deobfuscation of the Rhadamanthys loader.
Mentioned as an example of malware previously hidden in PNG-image steganography in other ClickFix campaigns.
Infostealer that steals browser passwords, active session cookies, and autofill data; the article says it was affected by Operation Endgame in November 2025 but such families often resume activity.
Rhadamanthys3
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.