���h���z����D~�h"��- ��������)�D�u��s�Y��D�� ��-��t����T���o"1Q!�>@YT�~s�X'�!�z<�h��vrw��z�)��M1���Y�����J&�Ƨ����N�H=0�%Z��B�RsS���~�����*��-�Ys�} O� �����1�Rt�A�����c�ťgdKK�W��hGPᙚ��>���D��>���vn'�)>�4��V�N��v�o� �� �x��2V�A�4~�ԍ6m=g(?��{\"s�����S|������ ���Ϟ�1S�=:ٮx���+>pJ�-��% �݇����1�ظlGMYi��5��:җ �tǨ��z�#��+�HR�H�~��w@�HE`�h�F�%���",�/�`L��,�Ó���[ ��n?7GR�[r�' ���w�wy�KS���7�cC���?&���zc��!*R�����Ҽĭ< z�}�1]�y@[1���Y�e�5)�0DP/W���#5����E1`�R�q��ܐ�Bl�7�/�}���JW��`�هY�4F�}�Ѫ֓-i������&�����h!�P��`�iL>�w[�A���3+�j"��[<ϊj�X�J��c�V@�:�O+ev��z1�"���M �s�ij�����G�5��s�F����������]7fzS�敖s@����m3��X�?���-D9��~��F`�� i}{��sa��2�����N����1�����i��WW^C=���xL��j�zK����ofQ�XJ��p���uԥ�`x6A"�V}�3��#fݬ��I�>���a&������,�6��z�`bC߰_�^n���������Wj� i��)�L��`=1y�"x��T����u�o�RV�&����hH'p�o ��>�蕲U���)f�����Q� �4�e�^�k�'�J���s���P��_uԄ:��1�����I��KS�������ӕ�QW���)c]ay'�m�f��L�� *@�~�6|��σ!0G�r5t[�y*8�Z�}�E���ȞB�1ĻMD�~��E=B: P1g-����\ޡ���U����U���]�!m�UG�����í�0��r�vٙذt��jd��c�&��$�_"K��s�p�q�K���"iC��%Bس�G|����P���K���T�U��~�����:gJ'=f P��3�'�QkR�ϠRɖ�����^�k��CX�~~�Sq�<�p�kqo��K��K��RZ�fx\�^Wcb-�-pZ(mS[���Vq�J����'�9P��J@=r#o�R\���S�y��a ��#�������h���f�J��ܒ��ߍQ̻�� DG6_�.�uyUM)Y���������X��N%�)�.Ni0>*�b(�F�9�7R�f��c|��`���|��x�̹����=�G�QIU>O�x��]�֤�`r9�DZ��v��h�KRki��[���{�wI*BH����J/Z?}U�uc��8[�O��{-����N��?�M���\�j-��|���0��������<=�vf���谲ƅm\DmH?d�U�S�<)q��7/p7w���C��6�;~��*1�`7;P������봧��.�����u�מ��_7����&Xy��-'�{03*ڃ �f�1��죬ug��Q��j�獿X� 8��,�/4��q�MJ�,�8�%+7+hM�K/#mK=��X���> �=�e�-�Z��c�����F� �Qx�� %Ӡ�[G� ��8�0^)�ȃ�mi������TL�� �>_Bo9�z�G�> ��f. �j�R�Q��Pb*�ث.��E�z����I>xήYk�vŋ��%�hE�Z�V���M�V6/��ך�j�"�%���i$��2��yk$���F���0�B����ӑ�胤ň}9G�gO }�S����L+��VlZ��E�u�~�;�d��ō����������u��¸�%�W��:���:�nj� �¤����q����\r�=�}���T:W����q6 ��n�����]������vrA� L�ه�q�J���X�{���{�:����f�(����r�P��+�U^Q�Q��r �$�����d�_�S5�456�t��#�0�;io 6�m=����Z�Q�Y��m��K}���( lڀ���G靚�(���SQ���М�ܡ7;̹�}�'4��S����&�H���lhI@��*��Z>��Q4IT�-;��Yw�OD�}�� ��ۆ���� ��Gm�����"y�Nk7;��j� �I7�ڏ9{o@�$��"��k�ݙ0��9:�-C��gdFͷ����EMN�����"�7t]��[�5(��~�[�������i�����]a���{�e4��_�\=�9��#6������7���zr���nB���>s�|��_�9���N�����ȉ`u�fd�}��`f�{�� �;�+Q]�� N@�le����97�74�GcJ0 |s���h����d��%L�c��1y3�����i$����,�J�E�dL�l�ƽ�r ��%@#C�y�G9X7N�@:�7�����{��:�Bm�D��%�Ict�Fʽ��se� ���vy����#t��������P3Li��!�*���ҳ�nJb��-�"e�~O^���H��M���iiI������|:\�n��� �c�B����c��F�"/B� ����:ZQy����HîS�Sd�Y���f�QG ʱv�FV��.���@DC4:��t�P!Q4do�08H+ߟ4����|�[����H��?lR+���<�� W�]o�ɴ�OR)���s��S� M��)�2l$J��n���|k��r锏RA*��h,S1�]�cja�ث�_=�T��&���O0�d �n�� ��ސw�^Q�h��d=%q��1o�D�T�ł��6�7�2arc�N;o�ɟ�$J"���r���@�%H5�� ��P�l�E*�-ܤ/v�������2B��'O@�{��I*y��~��������������G�(��@��N���O)t(��E�
Static task
static1
Behavioral task
behavioral1
Sample
RDR3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RDR3.exe
Resource
win10v2004-20240221-en
General
-
Target
RDR3.rar
-
Size
4.5MB
-
MD5
801148e8c693337e7772f8e7f61a3b0f
-
SHA1
656b415ee5a8864852d0c83ead56799615b426fd
-
SHA256
9618bf63c453ccc29ea87a3be8a4956166623164a1fae3a2759c960c2f5d3076
-
SHA512
dece94e232db7e2bda06c80d144501c33cbd4730b9a472daee5211acd001e23a67342d5552a2a839a666da6bd11a9c1d0d3fe61fcd0082baa1738e761ebca141
-
SSDEEP
98304:EuyRvy775rpZ7T/W3nIhj6YxUNtjZ3GtclnsN5mCAIrV3wSehnt8SFNzdTP8V:EE5r7T/W3IhjrxUXJfW5tNh3wHnt8wzS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/RDR3.exe
Files
-
RDR3.rar.rar
-
RDR3.exe.exe windows:6 windows x64 arch:x64
3283db44436f9cda0258af37cca51bae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentThreadId
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
advapi32
RegCloseKey
ntdll
NtQuerySystemInformation
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.gala Size: - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xys23 Size: - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.prom Size: - Virtual size: 889KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ax512 Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_gbit_ Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.2024 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tiko Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.limco Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dino Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ