=g�9������a�_����4���WEe���w�X~=��i|@<w"�9jX�)d惏H� q �Q���e�:Dn4���"PC�j]���A�F�'�%�L���G(d��P#�uR$�f��--��M�g���JKQZ��LX[41{}�+����j���$8Qmn���s}��=��ѝF�D�V�OH��6t����Pr7 YE5�4z�M�'��� �? �ճy�U5p}5����^F����<�Y������\5x|��DD'x��;Ʉ��s 6n P?�y�g���;��/�]�A�.)��A)m@p��F�+9�Y��gYO߈��G��<Õ�)q������){��Ri�~����T��{)�9�Mmꈬ\s���Z���߂��& ������W���M�t��P�� ���6_I��eگ��'���X�9�!�����`���UL�h�m��t�;ĸ��fU�`�����/�Ќ-�ˋ�����+~/���� �1�r��y����GK"lmi3b���;�985�t�e4�T�Z�bȅ6^��E^���Β5����/>�X�3��+��oLo���MB��T�Q�U%�m'үw^��N�ο�������$�fJu���EA��9��J�Np�jZE������\�d�����HE{��ѧ_��w��o�����HDxDF폾%H,�"�9�C��ٞ��?:e�<$����:9�"v27)���'52�yA��SDp @�i�H�(:4�g1����p'}�e�@�����`�f`{�n�A�Y�8V^�������$��,r��Tދ^������n���w�C�s}@��k����;й��cYvX�c!pfN�¢�"p��w�Z�8 ��k�Mt�)X�����mZ�"�E`zcπ�1�F����q,����|�>�c�F���/m�>W0V�]�t�E�����ܜ������/1��]�@yH쉪W��������22�p��^S�H�"�1O��L �V����120�2o̍4�&C8oYA�FP��\���`�8{,��O�5y�i�EΐcD�B�hT>��Y�����UP%ϔ�N6����8�}C����Yx����xgXh�����=â!7b��a~Ke�_R1�np*~$GM�|���1�!������?�]'����7��ޝ3�²�\j>�Yy�A��j��������$�g)}^�ຊt\����r���$Q �d�������ib^��^�+���+���𢷎HrFeS�7�M>���l[�B3�U ؙ(�!��V���^2�����p�}�&&����d��)�wM\�H�>W�4��jG�@�x�=���k�Q�e��ոc����Þ�b��3��g�䬥Ė����m� ���<��J��Βi7�X(��wG���>��n�?������i�b�dC�`�(@���A�t��ﺼ�M1��� �U��B��S��ѐ<�1�u�n=�MS���S+�?�5yR;Ȅgwt9�aJ�S�V�(�L��@�����=;��l��|�Ƿ��d�3��k��m��`h�E������W�୰����iH^i7 4q�JZ;��}]�����ws!J�2 �|+H���DaN2gH��l��l��<�2)�<��d�T�EC��������2�@�/�H���S�V�Q���H��.���>I���g���>���낗��x���ت�{��D�?쎛�@��E���>Ols�*��s�3���t� 1��m���%�ݣ����p���U}�1��SzA?���CW��ɋ�� ��Y�kt���la���@!�%�ٳ�X��ک�꽴��`��*� 嶰����/�;UeNF�W6�ӵcC�h(O��P�}��6NnC���|�0�wK&���bQW}�Z����Ʋ�omސѐ�+�+��5uǭ��{(5���bQ>�q�k��U$S�5J�mV����c =I��~Gjȴ ��x {���c�ic���� ����(��~�H>���,m;nލ�(29�=�������M�sg]���\AH�% e�s��^�k8��p��2�bBK�r�Fů�s//�[�_@$##���^�1dz������h�OKl��٩�=�S/�H�ç�28��+G��� �$���kW�@zgy��e$�I2>���yj��I��A?2��h�!2�K�Z��6%1� .�h���X�rTT��$��\ҚM��u� �ć_U��-ޛjG �y)��=����� P�o�l²wp�������[�8��uT~��/m�L�������5���\Ș�����f.�p��E��@���s�8,���]���c����S�����F�_�^K�Se���Oh�BTxt(2�q �B�W��͂e��#�b91�~19x�ա�(�5i�f �e��J�'v�������r��b��wf�N[�o��u�FX�����x7���?I�I���������1�o� �x�Ʊ�)rp��N�?^*@c�j��L����d��R�~!��1?��D_��۳�c��) �6Yzx��h.�����u��ES)d�g 8����Ȧ�j]�wK�-z@d�K? ��Ym�Ă���n��e�Y(gy�t�/Ͽq�P�p(����c������)-S�^�M��9n�3��>���b�J("o.�Ts,�j�A��� P��xnq�oq`hu�a�Dޮ��ya�!�( 큤g˫�fl}���p�&xȅ3��A�N���hB؞��ǃGOT�o�),C��3��o�˓����9R�PP?�=b͇o�o��-*-�,̚�lۖ��$���7{"�w���¸��{�M���i](M�H��l��m@��Ha�,}u^��6T�j���Y��g��'ă�G� n��z��k���<���>p���!?�8(h�N��0���96%*��/ߧѥb<�2H@�g[b��j�{0� Ĝjx�(�� �)��7� /w��IE�L�gZ����b3�i�rLs��s�A������;�&�� w����Ve�oC�̠�r�R�3֬���Y}�6��7l?P-9�骉Jn�����i�sQ�a
Static task
static1
Behavioral task
behavioral1
Sample
REDEYE.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
REDEYE.exe
Resource
win10v2004-20240802-en
General
-
Target
REDEYE.exe
-
Size
25.0MB
-
MD5
abed3b12d17a9f2082eea4e645df79c7
-
SHA1
9e7b846d50e184fa7051cab6d5a2cb4e6e507f7f
-
SHA256
8e7618f7992b49bfb1d4a0bd022139e9adf427e2a12a3bf585b852e780cb8473
-
SHA512
80caa6dce78ff57e409c10cb0d8e3b482c77f5693c1b80c644d28931a967095da590bb23de8caf1bd6337862468b2c66ded7365169f4bd9008b6ef0c2eaca494
-
SSDEEP
393216:cvBf94/CYKR2rwSX9TMriVCBsLZFWPWKc99BYibl2B0EByDC:ctiNKsHXNMrnqi+599GiblmBy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource REDEYE.exe
Files
-
REDEYE.exe.exe windows:6 windows x64 arch:x64
Password: 123
c41bd1507eecba862d6b32c89c5380ae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
ws2_32
WSACleanup
wldap32
ord211
crypt32
CertCreateCertificateChainEngine
kernel32
FreeLibraryAndExitThread
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDesktopWindow
CharUpperBuffW
advapi32
RegisterEventSourceW
shell32
ShellExecuteExA
ntdll
NtWriteVirtualMemory
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
dwmapi
DwmExtendFrameIntoClientArea
bcrypt
BCryptGenRandom
userenv
UnloadUserProfile
rpcrt4
UuidToStringA
imm32
ImmSetCandidateWindow
Exports
Exports
Sections
SIARAM#1 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
SIARAM#2 Size: - Virtual size: 20.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SIARAM#3 Size: - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SIARAM#4 Size: - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SIARAM#5 Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SIARAM#6 Size: - Virtual size: 4.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
SIARAM#7 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SIARAM#8 Size: 24.8MB - Virtual size: 24.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
SIARAM#9 Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ