Malware Analysis - Rhadamanthys
By Bar Magnezi
Published: 2024-07-12 · Archived: 2026-04-05 22:31:52 UTC
Sample:
fb6402d3ef1fcdd5af327668fa8d41b4
BackgroundPermalink
Rhadamanthys malware has been notably associated with the threat actor group known as Sandworm. Sandworm,
believed to have ties to Russian intelligence, It allows them to gain unauthorized access to computers, enabling
them to execute commands, steal data, and surveil victims through webcams and microphones. It spreads via
phishing emails and exploits software vulnerabilities.
Static Analysis - Stage 1Permalink
Figure 1: Malware Bazaar Entry
The first stage contained a relatively short PowerShell script that was somewhat obfuscated, as shown in Figure 2.
https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/
Page 1 of 11

Figure 2: Obfuscated PowerShell
After cleaning up the code and deobfuscating it, we were left with clear code, as shown in Figures 3 and 4.
Figure 3: After Cleaning
Figure 4: After Deobfuscation
The first URL downloads a PDF and opens it, while the second URL downloads a VBS file and executes it in the
background. Browsing to this URL revealed a lengthy, obfuscated VBS script.
Second StagePermalink
Figure 5: Long VBS Script
https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/
Page 2 of 11

After examining the code, I uncovered clues about the obfuscation technique employed. The method involved
filling the code with junk code, and in the middle of the script, a long string was constructed. Once I identified the
execution point, I disarmed it and echoed the final command to the console using CScript.
Figure 6: CScript Output
After cleaning up the code, I discovered an important function that functions similarly to a regex. This ‘regex’
essentially counts every sixth character and concatenates them into a new string. In Figure 7 you can find that
specific function.
Figure 7: Regex Function
Understanding that function led me to construct a regex in CyberChef, through which I successfully extracted the
next stage of the malware.
https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/
Page 3 of 11

Figure 8: Regex in CyberChef
Figure 9: After Decoidng the Whole code
As indicated in Figure 8 and 9, two URLs have been identified containing the next stage of the malware.
Third StagePermalink
Browsing to those URLs revealed the next stage along with additional files containing other variants as shown in
Figure 10 and 11.
https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/
Page 4 of 11

Figure 10: First URL
Figure 11: Second URL - Revealed 3 variants
The content of the file was loaded into the previous script and decoded from Base64. Using CyberChef, I decoded
the Base64 content of the file. At the end of the file, the actual code was revealed, as shown in Figure 11.
Figure 12: CyberChef Base64 Decode
https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/
Page 5 of 11

This part also utilized the previously analyzed regex function. Using the same technique to decode a new function
was revealed.
Figure 13: XOR Function Revealed
After analyzing this function, I discovered that it utilized XOR with the key 84 in Hex. An example can be found
in figure 14.
Figure 14: Using XOR
Before Decoding:
https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/
Page 6 of 11

Figure 15: Before XOR
After Decoding:
Figure 16: After XOR
That stage revealed memory manipulation and code injection techniques.
https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/
Page 7 of 11

Figure 17: Process Tree Using Procmon
Network AnalysisPermalink
Using Wireshark and Fiddler I was able to extract Network IOC’s:
https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/
Page 8 of 11

Figure 18: Wireshark DNS Requests
Figure 19: Fiddler Output
Virus TotalPermalink
https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/
Page 9 of 11

Figure 20: VT Url
Figure 21: VT Url
IOCsPermalink
Hash:
41961596aa91e91c8e4415cff137b345
4555c60872fad83c47c29b2052c978fd
d298368760f646f852027f697df07ee6
fb6402d3ef1fcdd5af327668fa8d41b4
05ed7b3d821af8e38b861b21ad567c1d
URL:
kuthbaneng[.]com
pineappletech[.]ae
almrwad[.]com
IP:
https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/
Page 10 of 11

184[.]171[.]244[.]231
103[.]21[.]59[.]27
91[.]195[.]240[.]94
Source: https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/
https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/
Page 11 of 11

  https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/  
Figure 17: Process Tree Using Procmon   
Network AnalysisPermalink    
Using Wireshark and Fiddler I was able to extract Network IOC’s:
   Page 8 of 11