rhadamanthys | 314fe9383a2d78cbd2bf0f8014210c53c346b7995d1e86f72ec4d666b43586c9 | Triage

Sharing

General

Target

314fe9383a2d78cbd2bf0f8014210c53c346b7995d1e86f72ec4d666b43586c9
Size

423KB
MD5

9335145d2c68b2abd12e736aff501801
SHA1

245615cff1c3d4435ff99999e6488a2608f6c0a1
SHA256

314fe9383a2d78cbd2bf0f8014210c53c346b7995d1e86f72ec4d666b43586c9
SHA512

be982d2239456c7c53a42dc3fce302fe76d90e46e7250392d2a00037c84f87be1a8cff438b719a92c704a3707c3583ffa16ccb490b8b8e448c1584107fad6564
SSDEEP

6144:/AYM3ZEWqf/qwPF7LR5W8ZJ74zmRiOFBbMh9q/JS53ChNeK06iiRzmy:/WBqf/qq3R5W8ZB4zmRzbaMsViR

Score

10^/10

rhadamanthys

Malware Config

Extracted

Family

rhadamanthys

C2

https://deadmunky.nl:3736/083f339e93162/kuegsocf.6wn8t

Signatures

Rhadamanthys family
rhadamanthys

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
314fe9383a2d78cbd2bf0f8014210c53c346b7995d1e86f72ec4d666b43586c9

Files

314fe9383a2d78cbd2bf0f8014210c53c346b7995d1e86f72ec4d666b43586c9
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 385KB - Virtual size: 385KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ