RMC6.0x_RMA7.0_update.zip
- SHA256 8d3f3a8abf36f2e8932a1e4217163d0256a220f932fc37dd0af00716c9b3c1cb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Redmoon/DATAs/rdmsys.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Redmoon/DATAs/rdmsys.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Redmoon/Redmoon.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Redmoon/Redmoon.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
Redmoon/info.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Redmoon/info.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target RMC6.0x_RMA7.0_update.zip
- Size 1.8MB
- Sample260801-pkrdwavejh
- SHA256 8d3f3a8abf36f2e8932a1e4217163d0256a220f932fc37dd0af00716c9b3c1cb
- MD5 b6f020d80706535918b28d3449c5f97f
- SHA1 c966f503e643552da957f311c98204395ba584c7
- SHA512 eacbd454d12dd735f7cac6f828c34d1b312e86f6999f24b4901a2341afd7a4ed42492b449158070c82d5e06874a6ec6702136d929881a454e3f61efc6ae70c14
- SSDEEP 49152:yr+lpUxAviSuiuTg7AxucHwh+48cV3Sr0rVaET8fzk4W:6+lpUxAvpAUAxuSG+awrSaxrk4W
- TLSH T17B953337199F294CD284C2F6930C1267C8718F8AF39A24447F8BB7C9A0E15691B52BDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Redmoon/Redmoon.exe
File Explorer
-
RMC6.0x_RMA7.0_update.zip.zip 1.8MB
-
Redmoon/DATAs/Info/Item06.rmi20KB
-
Redmoon/DATAs/Info/Message.ctf192KB
-
Redmoon/DATAs/Info/skill00.rmi15KB
-
Redmoon/DATAs/rdmsys.dll28B
-
Redmoon/RLEs/Ico/ico00013.rle95KB
-
Redmoon/RLEs/Ico/ico00014.rle86KB
-
Redmoon/RLEs/Ico/ico00083.rle187KB
-
Redmoon/RLEs/Ico/ico00084.rle187KB
-
Redmoon/RLEs/Ico/ico00085.rle188KB
-
Redmoon/RLEs/Ico/ico00086.rle188KB
-
Redmoon/RLEs/ico.lst34KB
-
Redmoon/Redmoon.exe.exe 1.5MB
-
Redmoon/info.dll50B
Redmoon/DATAs/Info/Item06.rmi
- SHA256 7c8acf05cb5ecf7c193f09a2ee53146f9d4029e3172843f7e0196c70f3c16528
- MD5 c4854d423063c24f91ea71b73adb79d8
- SHA1 fbbd687254dc05aafc86148fcd3f889d80a57f87
- SHA512 2f8ab385e1afcd0c2148acef12218a83638c9edcba9475977e4099895127e7d5cea3006d3de6ec58c60af1b6bf2dcae30240d305f939706ddf825b2abcfcbdb5
- SSDEEP 96:WslQJsvgmbGmMom+lSHPblRVTAHHHHs0B/17GUYAo1a6Uf35ZIVQ:rd3SvblMBd7HlLG
- TLSH T1B39257024FB14A92C91145BED5EB4310E738D084A5AAEB1303B6F13CBD936F5AF865AD
- MD5 SHA1 SHA512 SSDEEP TLSH
Redmoon/DATAs/Info/Message.ctf
- SHA256 eac236ba7123660c36679a9213447c8cb5e1b88c87b9d920608482e99b42f470
- MD5 c3624116a1a5558042f39bfa41b3a525
- SHA1 be425dc0b8a33e6c1ebb687241144c4022dc6d32
- SHA512 711417a840b71b9001c3431b68c2c5505f1fcba5846629b0a2509da95e219dba00e869aee7b17cf743b4a98c5adab3a3080cf0edbf9c7c66aa7cc03833fbf493
- SSDEEP 3072:ZukcV67KCoyfSROOe1UqCgU2f5gywAeKje5EHpXt3h0:ZFcoKCzweKqPHfgkTht2
- TLSH T18C14F80E7F50B322C071423165EB97617F38C068F7958B6BB428B8382D916667B7B5BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Redmoon/DATAs/Info/skill00.rmi
- SHA256 618853106297def876837d78b1c64a1d93c720a344c44990fd6f0e7c0dcfb4fb
- MD5 14dd5866a18213755c9b78e15f5b947b
- SHA1 ca54a9cd586945f8e5103ebfeaa15dde75c2a225
- SHA512 2b415501ba4e3b6ea0bf8bf732a54af72550d6f0c7514785defa1db7ec6915b8e95202aa733db41b5dad71874c8415db7a98a9be58fbca20fc4410400e6bf37c
- SSDEEP 96:3MrVW1TaRRtaOEOIfmRYIkcSXRr/Cc6RzvP9LeNuZ0jWXl+GIlbYrBKZvon+srXQ:3YqOKrIkoLS7j07oiM
- TLSH T13072DC75BF519813C4619738E3B90F906F24C8054211B34772B2F76DCEF23D46EAA46A
- MD5 SHA1 SHA512 SSDEEP TLSH
Redmoon/DATAs/rdmsys.dll
- SHA256 24433cde3b01a47cb692ae0f5563e6dc77eb325da2b598ecea9908511ed949a2
- MD5 ddda36d86768c316e0447a7297dfe462
- SHA1 d0e0413299b59e9f2526a83827ca789c381c8425
- SHA512 3e0ac0e4ea2222081d89ac035085614309a656e0e347eef851ca4d65492bdc60f6ed398f2b8bb04442a47d194f9f6e70e893641d4a6abcd456b33a47135fac91
- MD5 SHA1 SHA512
Redmoon/RLEs/Ico/ico00013.rle
- SHA256 83a3811efdfec41b639dfc87223bac7256e04e3be9d8e2e74aa3eeca194e6384
- MD5 838089a237f7796fb0e5edf806da929d
- SHA1 1da1693a5a461e1351d78fd5f7598f16a7375bcf
- SHA512 e45451d4fce6f361f175fd185578900f20894d94670f221d995a55d733e8340d76b17a22eb8f213fb6edf10c5da4d7f6d5b71005052f6183c3ba57770ea24416
- SSDEEP 1536:iMFG0R1Gj2ZPGGmWwp9EBHoGCOprnDdYNfU4qF+rdTq0cdd:iJjY5Vwp9ERX5DdYe+Y/dd
- TLSH T1A593C3516F5E9B97E8660F3001EE532437318A466A57D30F3124B3296C7E687FB7B888
- MD5 SHA1 SHA512 SSDEEP TLSH
Redmoon/RLEs/Ico/ico00014.rle
- SHA256 d8713824c35770375445a36c1470392b6659aef7c0047a5548d71b51ded05523
- MD5 1b5cd6335d6f2619edcc96e359b0505b
- SHA1 54a74359ff7b6c31295064b2d3a1bcc9fb2af6cd
- SHA512 6fab4befd96e36386a368f0125397569c04d280a6eb91b74e05e121582f6a02787bd55ee986d18216ba65da070d6ead62823142f5a41c970cc2a8d34d93e1aa2
- SSDEEP 1536:L0BtAvxQRhX5mkOsAn/07Wtr2kNW2A6IDMLmhtVH:LFviRhXh1An/0Sd2kw2xIDYcH
- TLSH T1348328126B9E8743E97A0E3148ED532073744E46AA9BD30E3121733568BF6C7EA7794C
- MD5 SHA1 SHA512 SSDEEP TLSH
Redmoon/RLEs/Ico/ico00083.rle
- SHA256 3e679ee4aed509c8d3c0ccd1a67806fe4edb29b87a49c257a986217c6dca84d7
- MD5 2d13c4550f7040636e6a80f6e9a00e53
- SHA1 25fda8adf0eeacf3c9c4d67e43fbc824ff672928
- SHA512 3cde6c39955b476c7c6ccbbe474e28b85bdb08741120f8df8fa0ee612aeaef073c2cc37314f81af07af80b1ef0e17330e4138b040da9f026865ba7b23cf6f7ce
- SSDEEP 3072:eMCl7ZXb09LDmJeirEs8xlF8iY/e7z2WGvacNUWW:E72y2eGWWmaAhW
- TLSH T17414FB53B3169AEFD05F4B7842C13B20E735C5AE336347D765268724ED2C2E28E626D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Redmoon/RLEs/Ico/ico00084.rle
- SHA256 6baae0578500d2c370bb3ec5735dd4a52870308045b43e7e8c23c9baa87b2007
- MD5 261dd986f0692d65345e3915d6d32f27
- SHA1 2a1ff55fc18e9450a6a514afa9b77048f1924c10
- SHA512 387a68b7388f19f4e53f6663bb8cd0da0b825ee4d668ca14beb96f2003bdc4058760b65773b079b4f33fa495e389195d9b2736a0a1834cab214bbb54a661f115
- SSDEEP 3072:XWMCl7ZXb09LDmJeirEs8xlF8iY/e7z2WGvacNUWW:872y2eGWWmaAhW
- TLSH T1C914FB53B3169AEFD05F4B7842C13B20E735C5AE336347D765268724ED2C2E28E526D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Redmoon/RLEs/Ico/ico00085.rle
- SHA256 c9a5617e462233af763a66fd16082d985f31135862b0568a184af54a91386b00
- MD5 7ecd05ae212cf204e01736b04b020f15
- SHA1 b21be7012c4685f46210020922a2de317f92473a
- SHA512 a38c4508a57f42b77792d17c8cd5ef80ecbc889da575059d980533c89522b283f3bcb7052be9075e09b50996d5074fd4453f01c2d302e7726124cbcb4ec0029b
- SSDEEP 3072:IMCl7ZXb09LDmJeirEs8xlF8iY/e7z2WGvacNUWW:672y2eGWWmaAhW
- TLSH T115140A53B3169AEFD01F4B7842C13B20E735C5AB336347D765268725ED2C2E28E626D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Redmoon/RLEs/Ico/ico00086.rle
- SHA256 5bbab4ef04b73590571f665c57c38001e03a90e9b0738896523ff0ce52974636
- MD5 81c87ba8f3f7e3ca6c7d7afade6189e9
- SHA1 c3f6bf47c4e6e0234a3ae20f1eb57967b01ee658
- SHA512 4841f76cff4022dc3a0ecdf5519fe090ecf14b29a4a18c06c77daac696748a8ca9419d42cf8b1822f118b11f272f07454de5830e5e87585be2c3bc25fa992455
- SSDEEP 3072:7MCl7ZXb09LDmJeirEs8xlF8iY/e7z2WGvacNUWW:X72y2eGWWmaAhW
- TLSH T105140B53B3169AEFD05F4B7842C13B20E734C5AB336347D765268728ED2C6E28E526D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Redmoon/RLEs/ico.lst
- SHA256 05091ae08c3706f76f16d9d666f0b7b5e14df1de6765da8468c2ca2d34528ffa
- MD5 621139b67d5025bb3f7c6caadc910d53
- SHA1 24ccf4e7028aaf9198127edd587cc812fec63767
- SHA512 d9055ada955393873127906ac7b24ea1d1dc09f155331c7ce44daf9c62b31ba00ff23c9bc2d6ec935b00d1ddb767ad3d69909e448fcd918a189542bd0f0bf322
- SSDEEP 384:H3BYqY7O0JRz5AkwdfEtC1htef7ka9+MVjFyM7fRQF7ss:H3+/dRm/dMtC167ka9+M+ML+F7T
- TLSH T191F267C7DDF3CA02CA296D364DE2C51E9376A9ABDDC8EF0BB35C34A563C1A523141918
- MD5 SHA1 SHA512 SSDEEP TLSH
Redmoon/Redmoon.exe
- IMPHASH baa93d47220682c04d92f7797d9224ce
- SHA256 4972d20377456f4addef340200fa7939f6ed0f3f2fd98487fc6c9609777cba8b
- MD5 9bd229623e96a83ab726b41293e5cc80
- SHA1 933230e6bd9e13436fbe76e9a64cd9d1fef2496a
- SHA512 4b3ce07646ce519d0c2a4778ed15d18ba01efa3ac1285c3eae9c33496cb4bf494e510b41bffb6269a7c68ef3fa09188a768a123abb2ba00f8e2398dd0e0b61e2
- SSDEEP 24576:HiZdiv6tjj3TPDvtXHmMfNUYkur9ph+MJzSnSUamjKw94MxKSHFLb8i7864D/:sivyj3jxHmMfN7997SSnmjueKu8i7l4j
- TLSH T118752325770ACACBEA1156BECE6417F282258EA8D4104BA751717E57FCF29C10EDB3E0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3166208
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpy
comctl32
InitCommonControls
Name
Size
32KB
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
xnaizmuc
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
finaouzu
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=11, version=8798,
count=2, id=12, version=7291,
count=12, id=19, version=8022,
count=2, id=19, version=9049,
count=3, id=11, version=8047,
count=2, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=11, version=8569,
count=2, id=4, version=8569,
count=12, id=19, version=8034,
count=336, id=1, productName=Unmarked objects,
count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
count=13, id=11, version=8966,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Redmoon/info.dll
- SHA256 308c0d602bb46e658b1ee92144eb323390e51daaac10bc0b348d960a97b648df
- MD5 c61fcb04606615c0e427c63052a840d0
- SHA1 f1f2c704814180af102c912eb259e91517d99c9f
- SHA512 2f23c03a2d3e92eb8e13f853ee861ec9d2e87f32d64e482c220f3a5ddd81e162994ad0e25aa57c2b2d405c31bb8b707b0cdce43da3a92cd639c35798d06bec46
- TLSH T1F1900211A744C448601551A22046646714A925698741C8C11840A415C4005610CC5460
- MD5 SHA1 SHA512 TLSH