redtiger | OptimizerPremuim[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
OptimizerPremuim.exe
Size 5.9MB
Sample250101-vb2fdatjb1
SHA256 ae9199799afe47a0c69f0cea10e924b8b72df340163b71f927fe0bcb6b6d7a96
MD5 093a4722c9529c8418108a3b36fdbc50
SHA1 ad07e278be2d58cc69175e809ca3741d0bdc29be
SHA512 143ce8b38934724e1473b11a854edd2fa87e1e3de3316e5c5c542face9c3c32368888ef9b3c50949782c22a193d4854eb23855e1a2fb2b06439fe7dec65d2da4
SSDEEP 98304:r75moDUN43WQqrjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6a+tMsF:H5umWQoOjmFwDRxtYSHdK34kdai7bN39
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealer redtiger blankgrabber

Malware Config

Signatures

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
static1/unpack001/zˆ��.pyc	blankgrabber

Blankgrabber family
blankgrabber

Detects RedTiger Stealer 14 IoCs

stealer

resource	yara_rule
sample	redtigerv122
sample	redtigerv22
sample	redtiger_stealer_detection
sample	redtiger_stealer_detection_v2
sample	staticSred
sample	staticred
sample	redtiger_stealer_detection_v1
static1/unpack001/zˆ��.pyc	redtigerv122
static1/unpack001/zˆ��.pyc	redtigerv22
static1/unpack001/zˆ��.pyc	redtiger_stealer_detection
static1/unpack001/zˆ��.pyc	redtiger_stealer_detection_v2
static1/unpack001/zˆ��.pyc	staticSred
static1/unpack001/zˆ��.pyc	staticred
static1/unpack001/zˆ��.pyc	redtiger_stealer_detection_v1

Redtiger family
redtiger

File Explorer

OptimizerPremuim.exe

.exe 5.9MB
zˆ��.pyc

857B

OptimizerPremuim.exe

IMPHASH a06f302f71edd380da3d5bf4a6d94ebd
SHA256 ae9199799afe47a0c69f0cea10e924b8b72df340163b71f927fe0bcb6b6d7a96
MD5 093a4722c9529c8418108a3b36fdbc50
SHA1 ad07e278be2d58cc69175e809ca3741d0bdc29be
SHA512 143ce8b38934724e1473b11a854edd2fa87e1e3de3316e5c5c542face9c3c32368888ef9b3c50949782c22a193d4854eb23855e1a2fb2b06439fe7dec65d2da4
SSDEEP 98304:r75moDUN43WQqrjOjFgFEblNHYSxTpirSHcUR43zrwkdA8QJCKC7bN3mb6a+tMsF:H5umWQoOjmFwDRxtYSHdK34kdai7bN39
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects RedTiger Stealer

stealer

PE Signature issue

Digest

b0:6a:f5:60:17:91:e5:c3:09:bb:9e:db:0a:6c:ba:32:2e:d7:88:a1:ef:a7:6c:fc:0e:c5:33:e6:f8:02:22:9b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Chains

Apr 25, 2023

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Serial Number

bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 29, 2021 - Sep 28, 2024

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

50048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage ShutdownBlockReasonCreate GetWindowThreadProcessId SetWindowLongPtrW GetWindowLongPtrW MsgWaitForMultipleObjects ShowWindow DestroyWindow CreateWindowExW RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW GetMessageW

kernel32

GetTimeZoneInformation GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage GetStringTypeW FormatMessageW GetLastError GetModuleFileNameW LoadLibraryExW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW HeapSize RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LocalFree SetConsoleCtrlHandler GetConsoleWindow K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte GetFileAttributesExW HeapReAlloc WriteConsoleW SetEndOfFile GetDriveTypeW IsDebuggerPresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers SetEnvironmentVariableW

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

Sharing

General

Malware Config

Signatures

File Explorer

OptimizerPremuim.exe

PE Signature issue

user32

kernel32

advapi32

generic

zˆ����.pyc

zˆ��.pyc