Extracted

• • Target

    ReadPCIRegisters.exe

  • Size

    1.3MB

  • MD5

    ea24df042e732db0122de161be0dd8fc

  • SHA1

    4a697d9a960f02c21d3e10e1a032867abe040db3

  • SHA256

    0b5479411aa07c990ac5d4a5e5c1b2a5d2ea1e8347b49aba2aab225667270e9a

  • SHA512

    5e0faa83fe6c9fb2fcacca96a3b4486e2ccb1894b20ff5e11d76fcf975dc6f3a232913668f3e89603e1088c41e6834989bcf6f715a0d1d678eebf463a423096e

  • SSDEEP

    24576:xnsJ39LyjbJkQFMhmC+6GD95vhkEp3W8AD/Dhd+y4lqJ8QdCYDoDNb:xnsHyjtk2MYC5GDfvhsvD/DX+y4onCYm

  Score

  10^/10

  redosdrudiscoverydownloaderloaderpersistence

  • Redosdru

    Redosdru is a loader/downloader written in C++.

    loaderdownloaderredosdru

  • Redosdru family

    redosdru

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2

• • Target

    WinRing0x64.dll

  • Size

    61KB

  • MD5

    eb31c77ef331ec4cbf7262cda4d1233a

  • SHA1

    ffeb0f08f18a4eca1bf8c4e827f9111ae3c64716

  • SHA256

    a746fd5728e7485f741cc330a279674bc8590b1b8007d8614046c49f58698485

  • SHA512

    b1143d419e278c1b09ad5d750d5dea1fa95ffaec1c0ee7d9c0d7160929981e1b5815fd45d6e0f8ab7aff1cae4518cb4baf1ed69441a040bb584024c99aaea0d0

  • SSDEEP

    1536:7Vz2GiL9ZooLCYtdm2R6CKQlqlLLuNsCMku1fT:Pw9ZooftdLTKBLLAsCMkk

  Score

  1^/10
  behavioral3behavioral4

• • Target

    WinRing0x64.sys

  • Size

    14KB

  • MD5

    0c0195c48b6b8582fa6f6373032118da

  • SHA1

    d25340ae8e92a6d29f599fef426a2bc1b5217299

  • SHA256

    11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

  • SHA512

    ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

  • SSDEEP

    192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ

  Score

  1^/10
  behavioral5behavioral6