redtiger | Frat[.]exe

Resubmissions

25/01/2025, 05:20

250125-f1hbgaxpa13

11/01/2025, 14:00

250111-ra4bss1jev10

Sharing

Copy URL Twitter E-mail

General

Target
Frat.exe
Size 2.7MB
Sample250111-ra4bss1jev
SHA256 f19de3ad6a5bfa72e0f4afb9c89dfc3b1b82c0c0abcccff3b141c9e93cc12fe9
MD5 9b68284a369850d1a2ab06a7ad6347ea
SHA1 ef2b206118cbe899d8dc7def0000d8c7668e9b52
SHA512 424b2931d2904ec8c2a06d4e6ae470abaf5c1cdbef3d28468d94cab389be6287cb0e9647303bced534f43abee1c3f4b260f79bda7228586fad9a34959b3fa5b5
SSDEEP 49152:RovDaz4y3VLuxuMvAKrTZrNyAk2dEzkhT8p609LR:R0YjVqxdAGTZ10t9R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealer redtiger

Malware Config

Signatures

Detects RedTiger Stealer 7 IoCs

stealer

resource	yara_rule
sample	redtigerv122
sample	redtigerv22
sample	redtiger_stealer_detection
sample	redtiger_stealer_detection_v2
sample	staticSred
sample	staticred
sample	redtiger_stealer_detection_v1

Redtiger family
redtiger

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Frat.exe

File Explorer

Frat.exe

.exe 2.7MB

Frat.exe

IMPHASH 3ef4a7ab7fdc2fe6a40ebe09a967d083
SHA256 f19de3ad6a5bfa72e0f4afb9c89dfc3b1b82c0c0abcccff3b141c9e93cc12fe9
MD5 9b68284a369850d1a2ab06a7ad6347ea
SHA1 ef2b206118cbe899d8dc7def0000d8c7668e9b52
SHA512 424b2931d2904ec8c2a06d4e6ae470abaf5c1cdbef3d28468d94cab389be6287cb0e9647303bced534f43abee1c3f4b260f79bda7228586fad9a34959b3fa5b5
SSDEEP 49152:RovDaz4y3VLuxuMvAKrTZrNyAk2dEzkhT8p609LR:R0YjVqxdAGTZ10t9R
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects RedTiger Stealer

stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

497044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\tryxz\Desktop\vpx-external\x64\Release\Fivem-External.pdb

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

GetTokenInformation RevertToSelf PrivilegeCheck SetTokenInformation OpenProcessToken SetThreadToken CreateProcessAsUserW RegQueryValueExW LookupPrivilegeValueW DuplicateTokenEx

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry

winhttp

WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest WinHttpCloseHandle

kernel32

AreFileApisANSI GetStartupInfoW GetCommandLineW GetCurrentProcess OpenProcess CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW CloseHandle ExitProcess MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock SetUnhandledExceptionFilter GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetFileInformationByHandleEx GetModuleHandleW WriteProcessMemory ReadProcessMemory TerminateProcess GetFileAttributesExW FindFirstFileW FindClose CreateFileW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent WakeAllConditionVariable Sleep UnhandledExceptionFilter GetCurrentProcessId GetSystemTimeAsFileTime

user32

CreateWindowExW MapWindowPoints DefWindowProcW MoveWindow GetWindowRect SetWindowLongW GetDesktopWindow SetForegroundWindow GetKeyState GetMessageExtraInfo SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetAsyncKeyState DispatchMessageW GetCursorPos PeekMessageW TranslateMessage

msvcp140

_Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Random_device@std@@YAIXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Mtx_unlock ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception _CxxThrowException __C_specific_handler strstr memmove memcpy __std_terminate memcmp memchr __std_exception_copy __std_exception_destroy memset __current_exception_context

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn terminate _register_thread_local_exe_atexit_callback _c_exit _exit exit _initterm_e _beginthreadex _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort _errno _set_app_type

api-ms-win-crt-math-l1-1-0

sinf acosf atan2f ceilf sqrtf fmodf __setusermatherr _dsign powf cosf

api-ms-win-crt-convert-l1-1-0

strtoull strtod atoi strtoll

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __p__commode _set_fmode fputc fflush __stdio_common_vsscanf _wfopen fclose __stdio_common_vfprintf fseek __acrt_iob_func ftell fwrite _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fgetc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

strcpy_s _wcsicmp strcmp

api-ms-win-crt-utility-l1-1-0

qsort