redline | Kiwi_X_External[.]rar

resource	yara_rule
static1/unpack001/Kiwi X External.exe	family_redline

resource
unpack001/Kiwi X External.exe

Kiwi_X_External.rar

SHA256 c69cadd6d4f1671a24e43ca864a0d2a7c5e37d527c68a49d716084a1d8dbdf14
MD5 d373484ddfcdda6f3f917abc776355ab
SHA1 b0516d4f1baffb4aafaf974c66a8f1e048f59624
SHA512 7d7fd94ad3f2520bb2746f2d7aee5a90af492374e41b8b8f4ac28cd24e7c790264d24e782d84a17997d9121d5de4dcfc44914cde6fb1a1097acb4078f0cf3a5b
SSDEEP 3072:SeQXML3nJYoQHUC+t2FT4tC7XVSX/Hl8i:2uJYowUC+MT4tCQfyi
MD5 SHA1 SHA512 SSDEEP

Password

1234

DirectML.dll

SHA256 f6bc6b17675171391d7070c9f633a998cbbb809090f22aa7784fa7269b33ad4b
MD5 de95287016aa91859b6a40f7ad60f0b6
SHA1 d13e4a3f7055902504d77d34e76065b0a5e6daa2
SHA512 82ac6d5ff6e280e77a1bf47218f22ebaa952193b817c3fbf349c7886adb1ca42fb45b5aeccf76c404e42715e8503e7db917a09109481efb58ab02ef132342dcb
SSDEEP 384:rFSFSFSFSFSFSFSFSFSFSFSFSFSBDrugFLFsBgEFSFSFSFSFSFSFSFSFSFSFNSF0:j
MD5 SHA1 SHA512 SSDEEP

Kiwi X External.dll

SHA256 f0c5ed7e3af2121cbdee6fab8ce640d0d349f416bc68670e10329e1cb20961ac
MD5 9734887d99d9ae7de1c40ad9d39d5f43
SHA1 1d576164b331474dc47df8f4c1891b4b66854e5c
SHA512 29152c938887beaf514aed323ab94ebe5ea238cd60ba47bc3ad557cb306355b81268430f43505295bdbe8c3f55ebff9abf087d6dba8b2b330c8ecbb56f44853a
SSDEEP 384:zFSFSFSFSFSFSFSFSFSFSFSFSFSBDrugFLFsBgEFSFSFSFSFSFSFSFSFSFSFNSFk:V
MD5 SHA1 SHA512 SSDEEP

Kiwi X External.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7b425b1bc9eb4868b4e27da2d4f1556f35d03814569fc3de2123c11b8608bc92
MD5 17203cf7ea11cbf5d1c2650ef9b6a869
SHA1 9b0392cbc7a6993aed66b79f78d6797f3d85295c
SHA512 5117875c1bda7b683a1561fea7393397d533c60f1045fe891050d5f4e686efa9d5f1b65d564dc52a6c2498e0eff2964964914cbd40d80611899bb7bc3a06a3e6
SSDEEP 3072:GqFFrqwIOG6vyFcGyXTk2jKSMivMc+tiOzl/xJT9afHITcZqf7D34aUa0twbBOa:dBIOGe/TM/lZJT9UucZqf7DIa6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

RedLine payload
Unsigned PE

Checks for missing Authenticode signature.

Password

1234

Minor OS version

0

Major OS version

4

Entry point

171958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Kiwi X External.runtimeconfig.json

SHA256 f36196c002f6103bb9c5e3fd9c5c13d433d4290747d10f2e75bb6365767d0b27
MD5 b54b4ef80765346e12640769405fbfa8
SHA1 3352dda088acee56526d2f33a4c96e263b5449dc
SHA512 7f5819e256216ee5296e33e4fb970e0393bffe5d2849281ed71ab41a35cd0cd928034581fb70280e55d71f5c99cad49327f54b57de9f3db904715b643bffcd18
SSDEEP 384:4FSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFS0:Q
MD5 SHA1 SHA512 SSDEEP

bin/HG.pfx

SHA256 29e7ff7919145adeec52dbc0943c43a68fe419517c26d0c9d25a69142de90f7e
MD5 3b279841ea6f53858bb3d92a53cf9c10
SHA1 08991db673519500a73d529b8177d2d69730fd16
SHA512 ffb6cbfc5809a3361b18a99ea5533aa263376b043064032b2ede7e84471b22040df65940444506325132a79efc745e535454d9bdc463aedc6ec0faa879a1a703
SSDEEP 384:rFSFSFSFSFSFSFSFSFSFSFSFSFSBDrugFLFsBgEFSFSFSFSFSFSFSFSFSFSFNSF0:P
MD5 SHA1 SHA512 SSDEEP

bin/SecrigoPublicCodeSigningCAR36.crt

SHA256 f36196c002f6103bb9c5e3fd9c5c13d433d4290747d10f2e75bb6365767d0b27
MD5 b54b4ef80765346e12640769405fbfa8
SHA1 3352dda088acee56526d2f33a4c96e263b5449dc
SHA512 7f5819e256216ee5296e33e4fb970e0393bffe5d2849281ed71ab41a35cd0cd928034581fb70280e55d71f5c99cad49327f54b57de9f3db904715b643bffcd18
SSDEEP 384:4FSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFSFS0:Q
MD5 SHA1 SHA512 SSDEEP

bin/sign.bat

SHA256 f0c5ed7e3af2121cbdee6fab8ce640d0d349f416bc68670e10329e1cb20961ac
MD5 9734887d99d9ae7de1c40ad9d39d5f43
SHA1 1d576164b331474dc47df8f4c1891b4b66854e5c
SHA512 29152c938887beaf514aed323ab94ebe5ea238cd60ba47bc3ad557cb306355b81268430f43505295bdbe8c3f55ebff9abf087d6dba8b2b330c8ecbb56f44853a
SSDEEP 384:zFSFSFSFSFSFSFSFSFSFSFSFSFSBDrugFLFsBgEFSFSFSFSFSFSFSFSFSFSFNSFk:V
MD5 SHA1 SHA512 SSDEEP

bin/vcruntime140.dill

SHA256 c2a67857f552183eb7954bd9f549765d214c7b257cfb66169cb9f6c48427b705
MD5 dbc45fe73b7303d5c69f76ba2ddf4ae5
SHA1 8c6b119ea81ff0b9bcda293f1ca379e5471df22b
SHA512 c6f76bfee6145f81cb80cfcc2c71c3552056bc3498b40ef406d2e157dcfe23ff3152090e15de59e3175a30359749e7d2ba082e423ed25296dbf448a036c3004f
SSDEEP 384:rFSFSFSFSFSFSFSFSFSFSFSFSFSBDrugFLFsBgEFSFSFSFSFSFSFSFSFSFSFNSF0:H
MD5 SHA1 SHA512 SSDEEP

bin/win-apo.config

SHA256 ca95a28ad016e52135aff5008756ccd5d1ebb322e893b28e99d578784156b3bf
MD5 a26e1988d85837df991b2e067359739a
SHA1 055c10a1ef587bed7c312fff998c112a87a03705
SHA512 a3024bb2160d5729e2da66190fab7d86b950c24d6f87730dbcbd4d80cf812e735d26d35f99f00d5dd0132165b056a12b514a49acfe68bb99a3d742ab1870f804
SSDEEP 384:rFSFSFSFSFSFSFSFSFSFSFSFSFSBDrugFLFsBgEFSFSFSFSFSFSFSFSFSFSFNSF0:f
MD5 SHA1 SHA512 SSDEEP

onnxruntime.dll

SHA256 29e7ff7919145adeec52dbc0943c43a68fe419517c26d0c9d25a69142de90f7e
MD5 3b279841ea6f53858bb3d92a53cf9c10
SHA1 08991db673519500a73d529b8177d2d69730fd16
SHA512 ffb6cbfc5809a3361b18a99ea5533aa263376b043064032b2ede7e84471b22040df65940444506325132a79efc745e535454d9bdc463aedc6ec0faa879a1a703
SSDEEP 384:rFSFSFSFSFSFSFSFSFSFSFSFSFSBDrugFLFsBgEFSFSFSFSFSFSFSFSFSFSFNSF0:P
MD5 SHA1 SHA512 SSDEEP

onnxruntime.lib

SHA256 c2a67857f552183eb7954bd9f549765d214c7b257cfb66169cb9f6c48427b705
MD5 dbc45fe73b7303d5c69f76ba2ddf4ae5
SHA1 8c6b119ea81ff0b9bcda293f1ca379e5471df22b
SHA512 c6f76bfee6145f81cb80cfcc2c71c3552056bc3498b40ef406d2e157dcfe23ff3152090e15de59e3175a30359749e7d2ba082e423ed25296dbf448a036c3004f
SSDEEP 384:rFSFSFSFSFSFSFSFSFSFSFSFSFSBDrugFLFsBgEFSFSFSFSFSFSFSFSFSFSFNSF0:H
MD5 SHA1 SHA512 SSDEEP

Kiwi_X_External.rar

DirectML.dll

Kiwi X External.dll

Kiwi X External.exe

mscoree

dotnet

Kiwi X External.runtimeconfig.json

bin/HG.pfx

bin/SecrigoPublicCodeSigningCAR36.crt

bin/sign.bat

bin/vcruntime140.dill

bin/win-apo.config

onnxruntime.dll

onnxruntime.lib

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Kiwi_X_External.rar

DirectML.dll

Kiwi X External.dll

Kiwi X External.exe

mscoree

dotnet

Kiwi X External.runtimeconfig.json

bin/HG.pfx

bin/SecrigoPublicCodeSigningCAR36.crt

bin/sign.bat

bin/vcruntime140.dill

bin/win-apo.config

onnxruntime.dll

onnxruntime.lib