stealer
Rhadamanthys
Named by 1 report, 6 detection rules, 1 IOC feed and 1 tracked actor.
Also written as: Rhadamanthys (vendor product). These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
Rhadamanthys MaaS Customer Deep-Dive (79.137.192.3)
MALW_Rhadamanthys_FrontbSection, MALW_Rhadamanthys_Q3VMBytecodeModifiedMagic, MALW_Rhadamanthys_OperatorLoaderStrings, MALW_Rhadamanthys_Stage2_ImportSurface, MALW_Rhadamanthys_CustomerCBCXOR_IV, MALW_Rhadamanthys_LoaderRC4Key
IOC feeds
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-010: Rhadamanthys MaaS customer with a self-built loader (customer side only, never the vendor)
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.