8d3f3a8abf36f2e8932a1e4217163d0256a220f932fc37dd0af00716c9b3c1cb

General

Target
RMC6.0x_RMA7.0_update.zip
Size 1.8MB
Sample260801-pkrdwavejh
SHA256 8d3f3a8abf36f2e8932a1e4217163d0256a220f932fc37dd0af00716c9b3c1cb
MD5 b6f020d80706535918b28d3449c5f97f
SHA1 c966f503e643552da957f311c98204395ba584c7
SHA512 eacbd454d12dd735f7cac6f828c34d1b312e86f6999f24b4901a2341afd7a4ed42492b449158070c82d5e06874a6ec6702136d929881a454e3f61efc6ae70c14
SSDEEP 49152:yr+lpUxAviSuiuTg7AxucHwh+48cV3Sr0rVaET8fzk4W:6+lpUxAvpAUAxuSG+awrSaxrk4W
TLSH
T17B953337199F294CD284C2F6930C1267C8718F8AF39A24447F8BB7C9A0E15691B52BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Targets

- Target
  Redmoon/DATAs/rdmsys.dll
- Size 28B
- SHA256 24433cde3b01a47cb692ae0f5563e6dc77eb325da2b598ecea9908511ed949a2
- MD5 ddda36d86768c316e0447a7297dfe462
- SHA1 d0e0413299b59e9f2526a83827ca789c381c8425
- SHA512 3e0ac0e4ea2222081d89ac035085614309a656e0e347eef851ca4d65492bdc60f6ed398f2b8bb04442a47d194f9f6e70e893641d4a6abcd456b33a47135fac91
- MD5 SHA1 SHA512
Score

1^/10
behavioral1 behavioral2
- Target
  Redmoon/Redmoon.exe
- Size 1.5MB
- SHA256 4972d20377456f4addef340200fa7939f6ed0f3f2fd98487fc6c9609777cba8b
- MD5 9bd229623e96a83ab726b41293e5cc80
- SHA1 933230e6bd9e13436fbe76e9a64cd9d1fef2496a
- SHA512 4b3ce07646ce519d0c2a4778ed15d18ba01efa3ac1285c3eae9c33496cb4bf494e510b41bffb6269a7c68ef3fa09188a768a123abb2ba00f8e2398dd0e0b61e2
- SSDEEP 24576:HiZdiv6tjj3TPDvtXHmMfNUYkur9ph+MJzSnSUamjKw94MxKSHFLb8i7864D/:sivyj3jxHmMfN7997SSnmjueKu8i7l4j
- TLSH
  T118752325770ACACBEA1156BECE6417F282258EA8D4104BA751717E57FCF29C10EDB3E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  Redmoon/info.dll
- Size 50B
- SHA256 308c0d602bb46e658b1ee92144eb323390e51daaac10bc0b348d960a97b648df
- MD5 c61fcb04606615c0e427c63052a840d0
- SHA1 f1f2c704814180af102c912eb259e91517d99c9f
- SHA512 2f23c03a2d3e92eb8e13f853ee861ec9d2e87f32d64e482c220f3a5ddd81e162994ad0e25aa57c2b2d405c31bb8b707b0cdce43da3a92cd639c35798d06bec46
- TLSH
  T1F1900211A744C448601551A22046646714A925698741C8C11840A415C4005610CC5460
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6