rhadamanthys | 3e3f9a4cf7c28e5245b97276c3b9124f[.]bin | Triage

Sharing

General

Target

3e3f9a4cf7c28e5245b97276c3b9124f.bin
Size

113KB
MD5

850c57169302a7237c8a2d0582f8106f
SHA1

6918aeabaf497ba45c8e2ef0ff993be5fcfe4c36
SHA256

e92ed81ec03c370a8efc6c13ce06e224213cfc4f4ed6840299c269dc4df866af
SHA512

d4c0758fd1e0004d78089acb92dda46454ada8767fac87c5376ea9090da355fe98e79fffef913ca0e384c46844084babe7c951ce3a3c050e3eb5c52aa8a0fdf8
SSDEEP

1536:Pb5H6UaRaUEUUhsSX4KWh2o6jvIbG93kD5rmFh9wTyY6hVKXHBvCDRXxOBUbkfdw:FHDsCSPK3o5y6QFh9wQ6XyjAhiJ

Score

10^/10

rhadamanthys

Malware Config

Signatures

Rhadamanthys family
rhadamanthys

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/f62527a0f56252621a8c7c18e0f5131bb53b4a5312dba42b4188b52345cc94a2.exe

Files

3e3f9a4cf7c28e5245b97276c3b9124f.bin
.zip

Password: infected
f62527a0f56252621a8c7c18e0f5131bb53b4a5312dba42b4188b52345cc94a2.exe
.exe windows x86

Password: infected

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ