Overview

overview

10

Static

static

10

DirectML.dll

windows7-x64

1

DirectML.dll

windows10-2004-x64

1

Kiwi X External.dll

windows7-x64

1

Kiwi X External.dll

windows10-2004-x64

1

Kiwi X External.exe

windows7-x64

10

Kiwi X External.exe

windows10-2004-x64

10

bin/sign.bat

windows7-x64

1

bin/sign.bat

windows10-2004-x64

1

onnxruntime.dll

windows7-x64

1

onnxruntime.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    Kiwi_X_External.rar

  • Size

    100KB

  • MD5

    d373484ddfcdda6f3f917abc776355ab

  • SHA1

    b0516d4f1baffb4aafaf974c66a8f1e048f59624

  • SHA256

    c69cadd6d4f1671a24e43ca864a0d2a7c5e37d527c68a49d716084a1d8dbdf14

  • SHA512

    7d7fd94ad3f2520bb2746f2d7aee5a90af492374e41b8b8f4ac28cd24e7c790264d24e782d84a17997d9121d5de4dcfc44914cde6fb1a1097acb4078f0cf3a5b

  • SSDEEP

    3072:SeQXML3nJYoQHUC+t2FT4tC7XVSX/Hl8i:2uJYowUC+MT4tCQfyi

Score
10/10
robloxredline

Malware Config

Extracted

Family

redline

Botnet

roblox

C2

77.246.158.53:13551

Signatures

  • RedLine payload 1 IoCs
  • Redline family
    redline
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Kiwi_X_External.rar
    .rar

    Password: 1234

  • DirectML.dll
  • Kiwi X External.dll
  • Kiwi X External.exe
    .exe windows:4 windows x86 arch:x86

    Password: 1234

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Kiwi X External.runtimeconfig.json
  • bin/HG.pfx
  • bin/SecrigoPublicCodeSigningCAR36.crt
  • bin/sign.bat
  • bin/vcruntime140.dill
  • bin/win-apo.config
  • onnxruntime.dll
  • onnxruntime.lib