Static task
static1
Behavioral task
behavioral1
Sample
redis-server.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
redis-server.exe
Resource
win10v2004-20230703-en
General
-
Target
redis-server.exe
-
Size
1.6MB
-
MD5
a925e3ae1a1a4a4747ffbed15d094cee
-
SHA1
6abe4b200aa7881d25f420eb54272f138e0baa5c
-
SHA256
94b8eb8973ea2b3ab230ff06bd7c3557f7df7deb884d6ed39303e5c5dc4a83a1
-
SHA512
d76244d91c8ec285fc2b5ccd4df848ce3d1297c8be49ae2f0276150571482c8037d7e1583cda1d40f4a313a279f0fdd7e35516d79bcca181b970adc2bcd4e565
-
SSDEEP
49152:iivqJxYqMd3NcAykAo1WyP0YCCiLcU0QWc/Vt8r65:2cAJCi5Vmr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource redis-server.exe
Files
-
redis-server.exe.exe windows x64
f05a9c3b074b88631898e6742300dfc9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
DeleteCriticalSection
GetSystemInfo
GetFullPathNameA
TerminateProcess
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
CopyFileA
LoadLibraryA
CreateFileMappingA
MapViewOfFileEx
UnmapViewOfFile
DeleteFileA
GetConsoleScreenBufferInfo
HeapAlloc
HeapFree
HeapCreate
SetEndOfFile
SetFilePointerEx
SetHandleInformation
FlushFileBuffers
GetNamedPipeHandleStateW
GetFileType
SetNamedPipeHandleState
CreateFileA
GetCurrentProcess
SetEvent
GetTickCount
WriteFile
ReadFile
SetCurrentDirectoryA
CreateNamedPipeA
CreateEventW
GetModuleFileNameA
OutputDebugStringA
LocalFree
CreateThread
MoveFileExA
MapViewOfFile
VirtualQuery
VirtualFree
OpenProcess
VirtualAlloc
VirtualAllocEx
ResetEvent
CreateFileMappingW
GlobalMemoryStatusEx
IsDebuggerPresent
VirtualProtect
DuplicateHandle
GetCurrentProcessId
DebugBreak
ResumeThread
CreateFileW
MultiByteToWideChar
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
GetCurrentThreadId
QueryPerformanceCounter
GetSystemTimeAsFileTime
QueryPerformanceFrequency
GetEnvironmentVariableW
GetStdHandle
SetConsoleTextAttribute
ScrollConsoleScreenBufferW
SetConsoleCursorPosition
WriteConsoleW
FillConsoleOutputCharacterW
SetConsoleCursorInfo
SetConsoleTitleW
GetConsoleTitleW
FillConsoleOutputAttribute
GetConsoleCursorInfo
GetProcessTimes
VerSetConditionMask
VerifyVersionInfoW
FreeLibrary
GetCurrentDirectoryA
RtlCaptureContext
SetUnhandledExceptionFilter
GetCurrentThread
GetTimeZoneInformation
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
GetDriveTypeW
IsProcessorFeaturePresent
SetConsoleCtrlHandler
GetCommandLineA
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
FileTimeToSystemTime
ExitThread
LoadLibraryExW
GetACP
CreatePipe
GetConsoleMode
ReadConsoleW
SetStdHandle
GetConsoleCP
GetModuleFileNameW
HeapReAlloc
RtlUnwindEx
SetLastError
GetStartupInfoW
IsValidCodePage
GetOEMCP
GetCPInfo
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetCurrentDirectoryW
GetProcessHeap
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
RtlPcToFileHeader
RaiseException
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetFileAttributesExW
OutputDebugStringW
SetEnvironmentVariableA
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
FormatMessageA
CloseHandle
GetModuleHandleA
CreateIoCompletionPort
PostQueuedCompletionStatus
GetProcAddress
GetLastError
WriteConsoleInputW
GetQueuedCompletionStatus
DeleteFileW
dbghelp
SymGetModuleBase64
SymSetOptions
SymInitialize
SymFunctionTableAccess64
SymGetLineFromAddr64
StackWalk64
SymGetSymFromAddr64
shlwapi
PathRemoveFileSpecA
PathIsRelativeA
PathCombineA
psapi
GetPerformanceInfo
user32
wsprintfW
advapi32
ChangeServiceConfig2W
StartServiceA
CreateServiceA
GetTokenInformation
SetNamedSecurityInfoA
SetEntriesInAclA
OpenSCManagerW
DeleteService
StartServiceCtrlDispatcherA
OpenProcessToken
CloseServiceHandle
OpenServiceA
QueryServiceStatus
SetServiceStatus
RegisterServiceCtrlHandlerExA
ControlService
GetNamedSecurityInfoA
RegisterEventSourceA
RegSetValueExA
RegQueryValueExA
DeregisterEventSource
RegDeleteKeyA
RegCreateKeyA
ReportEventA
RegOpenKeyA
RegCloseKey
shell32
ShellExecuteExA
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 230KB - Virtual size: 229KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 133KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ