Tech Analysis of Rhadamanthys Obfuscation Techniques

This report presents a technical analysis of the Rhadamanthys malware family, detailing its multi-stage loader (initialization, decompression, loader), VM-based obfuscation, encryption/compression schemes, an embedded virtual file system with helper modules, and a main module containing components for credential exfiltration (including a KeePass-focused module and Lua extraction scripts), code injection, and runtime execution of PowerShell and other payloads.