| Hash / Info | Value |
|---|---|
| SHA256 | a0b1944382e2fdec5e5640f45b7841b95e9c93dfa3f4e4f02b603cf1f7e68222 |
| MD5 | 4bc285601e9d547443a5d4b27cacfbaa |
| SHA1 | ab40e42f89da3f3f60ae11804b0b54b62c55dcf2 |
| File Adi | third stage.ps1 |
| File Type | ps1 |
| Size | 1,482 bytes |
| First Seen | 2026-01-27 |
Tehdit Valuelendirmesi
Bu ornek, etkilenen sistemlerdeki hassas kimlik bilgilerini ve kisisel verileri toplayan bir bilgi hırsızı (infostealer) olarak siniflandirilmistir. Tarayici kayitli parolalar, cerezler, kripto para cüzdani verileri ve oturum tokenlari birincil hedefleridir.
Detected Capabilities
- Tarayici Kimlik Bilgileri
- Cerez Hirsizligi
- Kripto Cüzdan
- 2FA Kodu
- Sistem Bilgisi
MalwareBazaar Tags
Analysis Note
Bu ornek Rhadamanthys ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
Rhadamanthys — Malware Profile
Rhadamanthys, 2022 de ortaya cikan C++ premium infostealer ailesidir. 250 USD/ay abonelik. Tarayici, kripto, FTP, VPN, email, oyun platformlarini hedefler. Loader + stealer DLL mimarisi.
Technical Details
C++, HTTP/HTTPS C2, modular plugin-tabanli mimari, genis tarayici credential theft, kripto wallet scraper (MetaMask/Phantom), steganography destekli payload, fingerprint (UUID/HWID), process injection
Capabilities & Behavior
IOC List (2 indicators)
# SHA256
a0b1944382e2fdec5e5640f45b7841b95e9c93dfa3f4e4f02b603cf1f7e68222
# MD5
4bc285601e9d547443a5d4b27cacfbaa
| Type | Value | Note |
|---|---|---|
| sha256 | a0b1944382e2fdec5e5640f45b7841b95e9c93dfa3f4e4f02b603cf1f7e68222 | |
| md5 | 4bc285601e9d547443a5d4b27cacfbaa |
C2 Servers (4 recorded servers for this family)
| Address | Type | Port | Protocol | Status | Country |
|---|---|---|---|---|---|
| 94.131.106.195 | ip | 443 | HTTPS | inactive | RU |
| 185.106.122.144 | ip | 443 | HTTPS | inactive | CZ |
| 185.106.120.55 | ip | 80 | HTTP | inactive | RU |
| 176.46.152.62 | ip | 5858 | HTTP | inactive | — |
C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.