rhadamanthys | 2026-08-04_ac6ae6f6a468c133da33c585d0a4be50_cobalt-strike_coinminer_icedid_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_ac6ae6f6a468c133da33c585d0a4be50_cobalt-strike_coinminer_icedid_satacom_vidar
Size 448KB
Sample260804-gl43csdh89
SHA256 6817f92096195e28fe62599eccdd425a58555ef5a01c3783a6f101cc0e0f6656
MD5 ac6ae6f6a468c133da33c585d0a4be50
SHA1 9f876ac1ed685219cadb789c76ae34ecae65131a
SHA512 b4b4f8aee7b105d6b0c2c0a787f3e55822aead0b3f46f120324d420812d04217df3fc6900c973281a7c7b47dd0450f43602909e52ca999b185fea2b56a00ccaf
SSDEEP 6144:FpOJNiES3OsC1hgZ7Mj3mshfV1dC405xnBRaF1Tpnypgza8oC6gspgyLXO:FxEECvgZ7Mj3mshfrdC425Hi11ZfA
TLSH
T195A44A8DB67B4DE6C5EA56FB80758280F1036C90B051C62AE69D9423EDD32D28FD1B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer rhadamanthys

Malware Config

Signatures

Family: Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Detects Rhadamanthys Loader v4.9 and higher 1 IoCs

resource	yara_rule
sample	Rhadamanthys_loader

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_ac6ae6f6a468c133da33c585d0a4be50_cobalt-strike_coinminer_icedid_satacom_vidar

File Explorer

2026-08-04_ac6ae6f6a468c133da33c585d0a4be50_cobalt-strike_coinminer_icedid_satacom_vidar

.exe 448KB

2026-08-04_ac6ae6f6a468c133da33c585d0a4be50_cobalt-strike_coinminer_icedid_satacom_vidar

IMPHASH 7982162fc07c5c56d2743590bfe85e5c
SHA256 6817f92096195e28fe62599eccdd425a58555ef5a01c3783a6f101cc0e0f6656
MD5 ac6ae6f6a468c133da33c585d0a4be50
SHA1 9f876ac1ed685219cadb789c76ae34ecae65131a
SHA512 b4b4f8aee7b105d6b0c2c0a787f3e55822aead0b3f46f120324d420812d04217df3fc6900c973281a7c7b47dd0450f43602909e52ca999b185fea2b56a00ccaf
SSDEEP 6144:FpOJNiES3OsC1hgZ7Mj3mshfV1dC405xnBRaF1Tpnypgza8oC6gspgyLXO:FxEECvgZ7Mj3mshfrdC425Hi11ZfA
TLSH
T195A44A8DB67B4DE6C5EA56FB80758280F1036C90B051C62AE69D9423EDD32D28FD1B3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Rhadamanthys Loader v4.9 and higher
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

320KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-08-04_ac6ae6f6a468c133da33c585d0a4be50_cobalt-strike_coinminer_icedid_satacom_vidar

kernel32

generic