���h���z����D~�h"��- ��������)�D�u��s�Y��D�� ��-��t����T���o"1Q!�>@YT�~s�X'�!�z<�h��vrw��z�)��M1���Y�����J&�Ƨ����N�H=0�%Z��B�RsS���~�����*��-�Ys�} O� �����1�Rt�A�����c�ťgdKK�W��hGPᙚ��>���D��>���vn'�)>�4��V�N��v�o� �� �x��2V�A�4~�ԍ6m=g(?��{\"s�����S|������ ���Ϟ�1S�=:ٮx���+>pJ�-��% �݇����1�ظlGMYi��5��:җ �tǨ��z�#��+�HR�H�~��w@�HE`�h�F�%���",�/�`L��,�Ó���[ ��n?7GR�[r�' ���w�wy�KS���7�cC���?&���zc��!*R�����Ҽĭ< z�}�1]�y@[1���Y�e�5)�0DP/W���#5����E1`�R�q��ܐ�Bl�7�/�}���JW��`�هY�4F�}�Ѫ֓-i������&�����h!�P��`�iL>�w[�A���3+�j"��[<ϊj�X�J��c�V@�:�O+ev��z1�"���M �s�ij�����G�5��s�F����������]7fzS�敖s@����m3��X�?���-D9��~��F`�� i}{��sa��2�����N����1�����i��WW^C=���xL��j�zK����ofQ�XJ��p���uԥ�`x6A"�V}�3��#fݬ��I�>���a&������,�6��z�`bC߰_�^n���������Wj� i��)�L��`=1y�"x��T����u�o�RV�&����hH'p�o ��>�蕲U���)f�����Q� �4�e�^�k�'�J���s���P��_uԄ:��1�����I��KS�������ӕ�QW���)c]ay'�m�f��L�� *@�~�6|��σ!0G�r5t[�y*8�Z�}�E���ȞB�1ĻMD�~��E=B: P1g-����\ޡ���U����U���]�!m�UG�����í�0��r�vٙذt��jd��c�&��$�_"K��s�p�q�K���"iC��%Bس�G|����P���K���T�U��~�����:gJ'=f P��3�'�QkR�ϠRɖ�����^�k��CX�~~�Sq�<�p�kqo��K��K��RZ�fx\�^Wcb-�-pZ(mS[���Vq�J����'�9P��J@=r#o�R\���S�y��a ��#�������h���f�J��ܒ��ߍQ̻�� DG6_�.�uyUM)Y���������X��N%�)�.Ni0>*�b(�F�9�7R�f��c|��`���|��x�̹����=�G�QIU>O�x��]�֤�`r9�DZ��v��h�KRki��[���{�wI*BH����J/Z?}U�uc��8[�O��{-����N��?�M���\�j-��|���0��������<=�vf���谲ƅm\DmH?d�U�S�<)q��7/p7w���C��6�;~��*1�`7;P������봧��.�����u�מ��_7����&Xy��-'�{03*ڃ �f�1��죬ug��Q��j�獿X� 8��,�/4��q�MJ�,�8�%+7+hM�K/#mK=��X���> �=�e�-�Z��c�����F� �Qx�� %Ӡ�[G� ��8�0^)�ȃ�mi������TL�� �>_Bo9�z�G�> ��f. �j�R�Q��Pb*�ث.��E�z����I>xήYk�vŋ��%�hE�Z�V���M�V6/��ך�j�"�%���i$��2��yk$���F���0�B����ӑ�胤ň}9G�gO }�S����L+��VlZ��E�u�~�;�d��ō����������u��¸�%�W��:���:�nj� �¤����q����\r�=�}���T:W����q6 ��n�����]������vrA� L�ه�q�J���X�{���{�:����f�(����r�P��+�U^Q�Q��r �$�����d�_�S5�456�t��#�0�;io 6�m=����Z�Q�Y��m��K}���( lڀ���G靚�(���SQ���М�ܡ7;̹�}�'4��S����&�H���lhI@��*��Z>��Q4IT�-;��Yw�OD�}�� ��ۆ���� ��Gm�����"y�Nk7;��j� �I7�ڏ9{o@�$��"��k�ݙ0��9:�-C��gdFͷ����EMN�����"�7t]��[�5(��~�[�������i�����]a���{�e4��_�\=�9��#6������7���zr���nB���>s�|��_�9���N�����ȉ`u�fd�}��`f�{�� �;�+Q]�� N@�le����97�74�GcJ0 |s���h����d��%L�c��1y3�����i$����,�J�E�dL�l�ƽ�r ��%@#C�y�G9X7N�@:�7�����{��:�Bm�D��%�Ict�Fʽ��se� ���vy����#t��������P3Li��!�*���ҳ�nJb��-�"e�~O^���H��M���iiI������|:\�n��� �c�B����c��F�"/B� ����:ZQy����HîS�Sd�Y���f�QG ʱv�FV��.���@DC4:��t�P!Q4do�08H+ߟ4����|�[����H��?lR+���<�� W�]o�ɴ�OR)���s��S� M��)�2l$J��n���|k��r锏RA*��h,S1�]�cja�ث�_=�T��&���O0�d �n�� ��ސw�^Q�h��d=%q��1o�D�T�ł��6�7�2arc�N;o�ɟ�$J"���r���@�%H5�� ��P�l�E*�-ܤ/v�������2B��'O@�{��I*y��~��������������G�(��@��N���O)t(��E�
Static task
static1
Behavioral task
behavioral1
Sample
RDR3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
RDR3.exe
Resource
win10v2004-20231215-en
General
-
Target
RDR3.exe
-
Size
4.9MB
-
MD5
340753116751ef6f5212667501a0e562
-
SHA1
ad4d25b43964c1c54accdcbe97a3f2ca80d15894
-
SHA256
b61907b9081bb5d7125264c5e60de013c02b7b866148248de603fb55f8d39a18
-
SHA512
d9564e38ea4000c16ebacc4a4b95925c8998d2bce33b3ad7bd0aa0b220d60f372d798591f4365b1271085036055519e4a94afd47d51ad5a2c6002e1f54ffc2f2
-
SSDEEP
98304:w4KoSKQ6Kob7IdoOPn49MWTB9z2OuVIsFx6fZPELW4sF+JKcNWdZRM9b7:wAXQFob7Idj/4VTbaVIsSBfFoxMnsb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RDR3.exe
Files
-
RDR3.exe.exe windows:6 windows x64 arch:x64
3283db44436f9cda0258af37cca51bae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentThreadId
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
RegCloseKey
ntdll
NtQuerySystemInformation
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.gala Size: - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xys23 Size: - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.prom Size: - Virtual size: 889KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ax512 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_gbit_ Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.2024 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tiko Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.limco Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dino Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ