Behavioral task
behavioral1
Sample
Sigmanly_fac561bb0f072d29fe6f8ee6072c905a.exe
Resource
win10v2004-20250314-en
General
-
Target
Sigmanly_fac561bb0f072d29fe6f8ee6072c905a
-
Size
353KB
-
MD5
fac561bb0f072d29fe6f8ee6072c905a
-
SHA1
da29dc6bd9ba38d11d46665e42bed7d5c35f48fc
-
SHA256
3d2013c2ba0aa1c0475cab186ddf3d9005133fe5f88b5d8604b46673b96a40d8
-
SHA512
0b5dcabd10c9cadbe6b98c3814a73a3d9f285578869821493d6cd7a87d1cdd1144de7a77dce1360b95c4ef0f96895a6f04c9dbbf15a3177866e9c2883b35727d
-
SSDEEP
6144:heigHPKpV1hH/lRLIRsdyhFNnofZwnADhY+xlgVv3M:UigHUz9lRvyLtiwnZ+xKU
Malware Config
Signatures
-
Detect Rhysida ransomware 1 IoCs
resource yara_rule sample family_rhysida -
Rhysida family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Sigmanly_fac561bb0f072d29fe6f8ee6072c905a
Files
-
Sigmanly_fac561bb0f072d29fe6f8ee6072c905a.exe windows:4 windows x86 arch:x86
36e77497d3c29d194a4ac4cc20116b1c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
CryptAcquireContextA
CryptGenRandom
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetFileAttributesA
GetHandleInformation
GetLastError
GetModuleFileNameW
GetProcessAffinityMask
GetStartupInfoA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
OutputDebugStringA
QueryPerformanceCounter
RaiseException
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
msvcrt
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_findclose
_findfirst
_fmode
_fullpath
_initterm
_iob
_lock
_lseeki64
_onexit
_setjmp3
_snwprintf
_ultoa
_unlock
calloc
exit
fclose
fflush
fgetpos
fopen
fprintf
fread
free
frexp
fseek
fsetpos
ftell
fwprintf
fwrite
malloc
memcmp
memcpy
memmove
memset
printf
raise
rand
realloc
rename
signal
sprintf
srand
strcat
strcmp
strcpy
strlen
strncmp
_write
abort
acos
system
time
vfprintf
wcscpy
_stati64
_findnext
longjmp
_strdup
_getcwd
_chdir
user32
MessageBoxW
Sections
.text Size: 250KB - Virtual size: 250KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 26KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE