Static task
static1
Behavioral task
behavioral1
Sample
redis-server.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
redis-server.exe
Resource
win10v2004-20230824-en
General
-
Target
redis-server.exe
-
Size
277KB
-
MD5
f14840db16b5612408e6ec61d354e3a8
-
SHA1
746971507648d82e8a65c3a29d543f179f508597
-
SHA256
2ae6144131bd57be750708db2978b1dcebef1c8de2e5b11d01cceb18227889e0
-
SHA512
911a2d004887f0b6ffd507286b5477c44e9103df4c3eeb2a4351e312c613d64572172068197e61b6cfc02777c401333b297fbc49fdd3669f3179247f2e3c0268
-
SSDEEP
3072:DFz6Bg9TXSpJe7L8f4CQ5d89dLvr7A2YF7aVsFk2YZPX6Dtjh2YxygPySEaXSO:DFOWXSpffc78bXNs25ZyvxygquiO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource redis-server.exe
Files
-
redis-server.exe.exe windows x64
91fc7b6e2c0cb598e54c30ceb4d6e196
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
SystemFunction036
kernel32
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
EnterCriticalSection
FlushFileBuffers
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessTimes
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
GetTimeZoneInformation
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryW
LockFile
MoveFileExA
MultiByteToWideChar
OpenProcess
OpenThread
PeekNamedPipe
QueryPerformanceCounter
ReleaseSemaphore
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEndOfFile
SetEvent
SetFilePointerEx
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
msvcrt
_chdir
_close
_fileno
_getcwd
_getpid
_open
_read
_unlink
_write
__C_specific_handler
__dllonexit
__doserrno
__getmainargs
__initenv
__iob_func
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_cwait
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_fmode
_fstat64
_get_osfhandle
_initterm
_localtime64
_lock
_lseeki64
_onexit
_pipe
_setmode
_stricmp
_time64
_unlock
_write
abort
atoi
calloc
exit
fclose
feof
fflush
fgetpos
fgets
fopen
fprintf
fputc
fread
free
fsetpos
ftell
fwrite
getc
getenv
islower
isprint
isspace
isupper
isxdigit
localeconv
malloc
memcpy
memmove
memset
perror
qsort
raise
rand
realloc
setlocale
signal
sprintf
srand
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strncmp
strstr
strtol
strtoul
tolower
toupper
ungetc
vfprintf
wcslen
user32
MessageBoxA
ws2_32
WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyname
getpeername
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohl
ntohs
recv
select
send
setsockopt
socket
Sections
.text Size: 214KB - Virtual size: 214KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 85KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE