Rhadamanthys Stealer: Forensic Reverse-Engineering & Architectural Dossier

Authored in high-performance native modern C++ (MSVC), Rhadamanthys represents one of the most structurally complex infostealers in the threat catalog. Its internal architecture is centered around a proprietary, custom-designed Virtual Machine (VM) and an encrypted Virtual File System (VFS). Rather than executing static x86/x64 routines for credential extraction, the binary decrypts an embedded bytecode image and feeds it into an internal register-based VM interpreter. Modules (browser theft, wallet scrapers, network stacks) are stored as compressed virtual modules inside the VFS container, unpacked into memory dynamically using LZ4 / Zstandard algorithms without writing artifacts to disk.

Rhadamanthys is distributed under a commercial Malware-as-a-Service model managed via a dark-web web panel. Operators configure payload build profiles through a web console that compiles customized stagers: targets include Chromium browsers, Gecko browsers, 100+ cryptocurrency browser extension IDs, desktop cold wallets (Exodus, Atomic, Electrum), email clients (Outlook, Thunderbird), FTP/SSH keys (FileZilla, PuTTY, OpenVPN), and specific file grabber path patterns (.txt, .pdf, .docx, .kdbx). The configurator compiles the operator's settings directly into the encrypted VM bytecode container embedded in the .data section.

struct Rhadamanthys_Stealer_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

Execution progresses across three internal stages: 1) The stager binary allocates a private memory arena using NtAllocateVirtualMemory. 2) Decrypts the proprietary VM bytecode interpreter and VFS container via ChaCha20/AES. 3) The VM interpreter begins executing virtual instructions via an opcode dispatcher loop. To evade endpoint detection and response (EDR) hooks, Rhadamanthys resolves syscall numbers dynamically at runtime by reading clean ntdll.dll code from disk or parsing the export directory in memory, directly issuing direct system calls (SSN execution) for memory protection and injection. It inspects loaded modules for inline hooks (checking for 0xE9 JMP or 0xCC INT3 bytes at export entry points); if hooks are detected, it overwrites the hooked bytes in memory with pristine opcodes extracted from the clean PE image on disk. It injects virtual modules into legitimate processes (such as rundll32.exe, WerFault.exe, or explorer.exe) via NtCreateSection / NtMapViewOfSection.

Concrete technical breakdown of functional modules implemented in the Rhadamanthys Stealer binary:

Rhadamanthys employs a proprietary network protocol disguised as TLS or transmitted over raw TCP sockets. The session initiates with a cryptographic handshake: 1) Key Agreement: Uses Curve25519 Elliptic-Curve Diffie-Hellman (ECDH) to establish a shared ephemeral secret key. 2) Session Key Derivation: Derives symmetric encryption keys using HKDF-SHA256. 3) Data Framing: Packets are compressed via LZ4 or Zstandard before encryption with ChaCha20-Poly1305 authenticated encryption. Packet Header Structure: [4 Bytes Custom Protocol Magic] [16 Bytes Session Identifier] [4 Bytes Payload Length] [12 Bytes Nonce / IV] [Encrypted Payload Data] [16 Bytes Poly1305 Authentication Tag]. Network exfiltration is performed in micro-chunks to evade perimeter DLP thresholds and network inspection engines.

Indicators of compromise and forensic patterns recorded across laboratory triage: