CROSSROAD/SHINYROAD/ADAPTAGENT binaries by PE metadata typo and known hashes

Suraj A@cytech

•updated 4 days ago•1•0•2

Detects indicators related to CROSSROAD/SHINYROAD/ADAPTAGENT activity, including specific PE version metadata typos ('AOMEI Update Compent'), known file hashes, and Radmin launchers running with the '--runtimechk' argument from the AppData directory.