Rubeus[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Rubeus.exe
Size

431KB
MD5

551294acf4ff1b28a919861a27c07509
SHA1

94be708ffa38c9722725216dc4c5738d45816aa4
SHA256

f91df5e666c817cbaf875319903832f63b76d3dbafa4a07da06bcf072c6f8cac
SHA512

477cec802d92f21fdcaa5c318066eb2df5e3ea312b095061659f1ac356ebe8feb95a530b19194c823c04771b08e3e4300bbd110e1beac67e7d9ee36bd73c699a
SSDEEP

6144:0/UVVVN+QJyUUt44oDyUfLRwtDwipVRg19rjyGF/Cmk7slJPA0LhUVkez0vZ6HEJ:0/aWt4DDTk7O8lWIEID

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Rubeus.exe

Files

Rubeus.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 428KB - Virtual size: 428KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ