redemption-bootstrapper-4[.]2[.]1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
redemption-bootstrapper-4.2.1.exe
Size 5.5MB
Sample260718-e6x4fabw9t
SHA256 597e38bf0b93c924fa5e6d73938392c9be1f4670dc6db17adcce2c0a61303082
MD5 0927117f24f7761c78fbe593c036ea9c
SHA1 b98ab1b42929de39043a55a83083e0ac129183b5
SHA512 3244e7e2500bd7d1a659ba0532f53d0e6d9ed5608d2b746964e2cce8a824fe4bd41603c7fe5bd2ca8d75b21870e4a816ed1ecfcefdd7ddfa14c83ffca7b31731
SSDEEP 49152:9Wpv/cs1Cx1GVrJ7O6JkmouOppgTocmJS0r2eEOpw0zTI9bbKJelrm0823eYIU66:9qv/cs1smo1w4EbNen+Pjl
TLSH
T101467D02BB47999DD05AC8B083468A638E2274DB0B36B5BF52C955393F6E7F05F1831E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
redemption-bootstrapper-4.2.1.exe

File Explorer

redemption-bootstrapper-4.2.1.exe

.exe 5.5MB

redemption-bootstrapper-4.2.1.exe

IMPHASH cdc09e2c8a9d2cd887f7812c9fde8c4f
SHA256 597e38bf0b93c924fa5e6d73938392c9be1f4670dc6db17adcce2c0a61303082
MD5 0927117f24f7761c78fbe593c036ea9c
SHA1 b98ab1b42929de39043a55a83083e0ac129183b5
SHA512 3244e7e2500bd7d1a659ba0532f53d0e6d9ed5608d2b746964e2cce8a824fe4bd41603c7fe5bd2ca8d75b21870e4a816ed1ecfcefdd7ddfa14c83ffca7b31731
SSDEEP 49152:9Wpv/cs1Cx1GVrJ7O6JkmouOppgTocmJS0r2eEOpw0zTI9bbKJelrm0823eYIU66:9qv/cs1smo1w4EbNen+Pjl
TLSH
T101467D02BB47999DD05AC8B083468A638E2274DB0B36B5BF52C955393F6E7F05F1831E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2852848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

redemption_bootstrapper.pdb

kernel32

GetCurrentThreadId GetModuleFileNameW LoadLibraryExW SetThreadErrorMode GetLastError GlobalFree GetOverlappedResult WriteFile Sleep GetModuleHandleA SetLastError SwitchToThread PostQueuedCompletionStatus ReadFile CreateWaitableTimerExW GetFinalPathNameByHandleW DeleteFileW SetFileInformationByHandle SetThreadStackGuarantee GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes GetCurrentThread CancelIoEx CreateFileW CloseHandle SetNamedPipeHandleState WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId CreateMutexA ReleaseMutex WaitForSingleObject CreateDirectoryW GetFullPathNameW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW FindClose SetFileTime GetTempPathW SetHandleInformation CreateThread WriteFileEx SleepEx ReadFileEx ExitProcess CreateProcessW GetFileAttributesW DuplicateHandle GetExitCodeProcess FreeLibrary GetProcAddress SetWaitableTimer InitializeSListHead SetUnhandledExceptionFilter GetSystemTimeAsFileTime GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency FormatMessageW GetModuleHandleW GetEnvironmentVariableW HeapAlloc WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle GetCurrentDirectoryW RtlVirtualUnwind lstrlenW LoadLibraryA RtlLookupFunctionEntry RtlCaptureContext GetSystemTimePreciseAsFileTime LoadLibraryW GlobalAlloc MultiByteToWideChar GlobalUnlock WideCharToMultiByte GlobalSize GlobalLock HeapReAlloc AddVectoredExceptionHandler GetCommandLineW HeapFree GetProcessHeap

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

advapi32

RevertToSelf ImpersonateAnonymousToken RegCloseKey RegQueryValueExW SystemFunction036 RegOpenKeyExW

ws2_32

getpeername recv WSASocketW ioctlsocket connect getsockopt bind WSAIoctl getsockname WSAStartup WSACleanup WSAGetLastError getaddrinfo freeaddrinfo send shutdown WSASend setsockopt closesocket

ntdll

NtOpenFile NtDeviceIoControlFile NtCreateFile NtWriteFile NtCancelIoFileEx NtCreateNamedPipeFile RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

opengl32

wglGetCurrentContext wglMakeCurrent wglGetProcAddress wglGetCurrentDC wglShareLists wglCreateContext wglDeleteContext

shlwapi

AssocQueryStringW

user32

SetClipboardData EmptyClipboard GetClipboardData IsClipboardFormatAvailable ReleaseCapture SetWindowDisplayAffinity SetWindowTextW FlashWindowEx SetCursorPos GetWindowTextW GetWindowTextLengthW MonitorFromWindow ClientToScreen DestroyIcon CreateIcon InvalidateRgn SetWindowPos GetWindowPlacement SetWindowLongPtrW CreateWindowExW RegisterClassExW DestroyWindow RedrawWindow DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjectsEx GetClassInfoExW DefWindowProcW DestroyCursor SystemParametersInfoA RegisterWindowMessageA ShowWindow GetSystemMenu EnableMenuItem RegisterRawInputDevices GetClassNameW LoadCursorW ChangeDisplaySettingsExW SetWindowPlacement GetMonitorInfoW GetWindowLongPtrW GetRawInputData ValidateRect MapVirtualKeyW GetWindowLongW GetMenu AdjustWindowRectEx TrackMouseEvent ScreenToClient MonitorFromRect SetCapture GetTouchInputInfo CloseTouchInputHandle GetKeyState GetWindowRect GetClipCursor ClipCursor ShowCursor GetKeyboardLayout MapVirtualKeyExW ToUnicodeEx GetKeyboardState SendInput SetForegroundWindow RegisterTouchWindow GetAsyncKeyState IsProcessDPIAware SetWindowLongW SetCursor GetCursorPos GetForegroundWindow MessageBoxW OpenClipboard CloseClipboard GetActiveWindow GetSystemMetrics SendMessageW CreateIconFromResourceEx GetClientRect IsIconic ReleaseDC GetDC PostMessageW EnumDisplayMonitors MonitorFromPoint

shell32

DragFinish DragQueryFileW

gdi32

SwapBuffers DescribePixelFormat ChoosePixelFormat CreateRectRgn GetDeviceCaps DeleteObject SetPixelFormat

ole32

RevokeDragDrop CoInitializeEx OleInitialize RegisterDragDrop CoCreateInstance CoTaskMemFree CoUninitialize

imm32

ImmAssociateContextEx ImmGetCompositionStringW ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext

bcrypt

BCryptGenRandom

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

vcruntime140

__current_exception_context memcpy memcmp __CxxFrameHandler3 __current_exception memset memmove _CxxThrowException __C_specific_handler

api-ms-win-crt-math-l1-1-0

floor sin ceilf __setusermatherr cosf expf cos floorf _hypotf cbrtf trunc atan2f sinf powf roundf acosf fmod round exp2f

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table terminate exit _initterm_e _exit _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _c_exit __p___argc _configure_narrow_argv _cexit __p___argv _initialize_narrow_environment _initterm _get_initial_narrow_environment _crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode