b042d816e2320ecb5ed3885672372d545eef80d1508a849d70b07fdc01fa7264

Sharing

Copy URL Twitter E-mail

General

Target
RedWing-Panel.zip
Size 26.9MB
Sample260821-dg65da1gla
SHA256 b042d816e2320ecb5ed3885672372d545eef80d1508a849d70b07fdc01fa7264
MD5 4300c68a92d18392898a7ebf17113d7f
SHA1 746b957013040db4807bbfe8cec410d0de634f5c
SHA512 7b5e39ae69dfd1605781a21588852f946d8b80140698c5f0a5b3d3fcad557030b62fb84c1af6b625e1560dced8cbc64bcb0ed4c06029bc1cb99556cfaeb4d987
SSDEEP 786432:RNneYz6lP5feoZO5qGNTKvJNDs0RSBDAAZ1C:RPGR5GgOJgJNDhRSBDA6c
TLSH
T13F57120BA7E9FCE0C78C99F2A94A554241325E617308CA2524DECE7ACE3E0D55B16F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.10.0.jar

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://dl.google.com/android/repository/build-tools_r35-windows.zip

Targets

- Target
  RedWing-Panel-main/bin/linux/server
- Size 11.6MB
- SHA256 a7ccd070b9dfc7f3c6fd079e81745203c68d5d95d39f53262ed1888bc1daa770
- MD5 6dc755e006f2bce731f94970df2662a9
- SHA1 46c38c1fa33cf02c1c4a0ea70138446db7825643
- SHA512 c6acfffcf952d52622bf5ad5e8335cb29286466d38bcd208a4c16b78cf1d8fdbb7e536439f6ae479d09f5b63ff56f626156fbdc24db4992781b58ab76bb2691f
- SSDEEP 98304:j55ngVfEEEKx5bNME1mN0nt2oaoKsC4vDTqktvGnEeZ:j8O/NIYo1VD9GEeZ
- TLSH
  T1B6C63947FCA545E4C0AE8176C6629663BB713C894B3033D36B50FA282F77BD0A9B9750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  RedWing-Panel-main/bin/windows/server.exe
- Size 11.9MB
- SHA256 bbf6fb75c65ed097beee7f6bec2aff6b6ba5c0e377ec0b1221b600c1d66cf661
- MD5 344489f94baabc154e66d4d3a005df00
- SHA1 1844b23851c32bea89a8558958e6d43a5ec513e1
- SHA512 30073a417c9765fe54ace71ca7310252e670b056ea0ec3cf99a692ff05b2100321c4448b02fe47368cb2b3508ddb7b96ee17818539744f276a107aca6cf902ca
- SSDEEP 98304:fnhfQ77oSEeJ0BgfIJpeYwpqD6oR35gEKGE6:f1KG2BoD1Rmjj6
- TLSH
  T181C63953EDA555E4C1AEC17AC6229213BF713C894B3063D76B90FA242F76BD0ADB9700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2 behavioral3
- Target
  RedWing-Panel-main/install-linux.sh
- Size 12KB
- SHA256 c89729063aef253c8b20ee42cfebdd98dc76158fbc94275a5545bea477660408
- MD5 80eb50beaab76144a3c7fd1b388bd49c
- SHA1 72213457a9f54454de974fdd41b23dd3a8e00d1e
- SHA512 91fde411d176f8e00536cb4db9122c36abbb724a584f1307d1066d8521749f562ba8d9e1fc958ddacdace93ca120767d1d820411d2287ebec427ad98aac8e46c
- SSDEEP 192:1lxslOlUZRiWfF19MAtd2e3O5PTf95ymuaGcvodIf+f+wFoZ:CVh2eqf95yGGcvoddfwZ
- TLSH
  T12E523FB9A45477743508C41D86B1E8483B8331EF3A39512AB0FDB09A3FFC59C97699B8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm credential_access defense_evasion discovery execution persistence privilege_escalation
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Deletes log files
  Deletes log files on the system.
  defense_evasion
- Enumerates running processes
  Discovers information about currently running processes on the system
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Modifies systemd
  Adds/ modifies systemd service files. Likely to achieve persistence.
  persistence privilege_escalation
- Write file to user bin folder
  persistence
behavioral4 behavioral5 behavioral6 behavioral7
- Target
  RedWing-Panel-main/install-windows.bat
- Size 11KB
- SHA256 ed51d3b9bfe3e4326914876e84552f6f0faefdc01485d34945a77ee36b7e88a1
- MD5 759ed60b6c8910384bece1027499ea2e
- SHA1 c29ab820e8b098d64234408398ed28200ba54711
- SHA512 904029e95ceb080fd18c64b340bc973728a036c0559aafb072e3ab9d9ac00526a69704a5934adaeaf80cd3cfd56c7901984e79637cc7b7c92ebc2e4b12f5a0a6
- SSDEEP 192:JId48t5LRoLhaalro7SSGSKSTyHab97aL67lfOuWHXYJlEZdQB6dY96RZWFdB:ed48t5LRoLhaalro7SSGSKSTeabVaLWj
- TLSH
  T15F3296573CED88A6284406A65F76539273A5C0A746057FDC32E6C01B9F1E3C907FAACA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral8 behavioral9
- Target
  RedWing-Panel-main/source/decom/apk_smali/lib/arm64-v8a/libcputune.so
- Size 241KB
- SHA256 b447dfabc87461553601327740fbeb525199095bc4d3c056a66360c34aae0c82
- MD5 ccd5faa77de53baed1f3524cba0e21a8
- SHA1 a7fafffa5b285d03414bd3433d9f8cd4531d4ebb
- SHA512 cb4859512832b96517078c039df35cb0c78e784cdb6709bc2a61fa46f725fd5c5022ea47c3d28d188fc5d2eab9099ba4092542f0befb278e61884180b877c4cb
- SSDEEP 3072:GnsHdrM0vN1lbFsgtHBcAiTBh0ADLwVNX86KB0xp+GIQ8f8H5m8VQ:GYvN1BFsgtHBYTQADLwVNX86g0xkGc8
- TLSH
  T14234191CEC1DDC35DED8B07DAA4913637A3239581324D2972A22852EF6C76C6D63FB42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral13
- Target
  RedWing-Panel-main/source/decom/apk_smali/lib/armeabi-v7a/libcputune.so
- Size 127KB
- SHA256 aff1f4b7c44da71c4ece6678fab740104abfd077cbf7901b340e516b84db5611
- MD5 251aa4c4e53f0f334c8f7d6697034757
- SHA1 53c2c34646657fed0d4d270a0750eda52c9f925f
- SHA512 6d1551d8cc99e1f6c9035c5f4cb4a4dba38ab4d7f4ba67292395a0872610906eba914c047f64ff081d23b67d175144bf834faff01dd5a028a751f08f945ea1d9
- SSDEEP 3072:RxMia3FsgurZlWvjr/53WUvAAHuuYJSHVQGtoVPOcG:RxMia3FsgurZl8PBeRG
- TLSH
  T1FDD37C58F8164C02C8AB9535B94E19CABB32C7DEA325C3725758A736BFA710D8D6E130
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  RedWing-Panel-main/source/decom/dropper_smali/lib/arm64-v8a/libxoafgxkgj.so
- Size 23KB
- SHA256 cab89ea748193a297f6d909f00bde7c6705a6e9ae6b9bbc148c44ba09d5bd6cc
- MD5 d5bc49797b89a87160a85802e04b6b47
- SHA1 60ea79db116f300e4ea0d60f0b240d3dc28bb87d
- SHA512 36c921a68a481ec0a9f881c9c6a1936f9220508ebb628db9e8a84febbe25ae2927b4bf13225f7ac1fc9505b9cdeefa6629822a51e6c83d881123485d122cac3a
- SSDEEP 384:n8XNd9ES2nMl8gnMoJsqRInf6jx3Yb+3wuuMhosSJYva37jQ:C/ES2nS8gMsRInf6jebF9ZX/Q
- TLSH
  T128B2E84AD64CED33EC9932BD0C870E63BE30654597A2C0D79562030EFE0B2D6D265B69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16 behavioral17 behavioral18
- Target
  RedWing-Panel-main/source/decom/dropper_smali/lib/armeabi-v7a/libxoafgxkgj.so
- Size 16KB
- SHA256 d988b0ccaae03ef57e5dd9ca3da74afbe7aee6bc6581f09ebcf69d64700572c2
- MD5 dcd04405a17b000909f9764ab67d2a46
- SHA1 5ea2f7d19cc7d9c1aea0741f455d18c5cf531cda
- SHA512 7480ebd1aeb7dbd409fa7f45467e877f4a9c47bdeeed2d241b4491f4e74a300031f87a25a29a891a4d81b1c34cce025d058d70535b29ebc8f3d6de4580178936
- SSDEEP 192:Gk2NgESn2nr4ljItOnbgoJsjBlYF04REwJil5ZdzBnsAb6mjvwqvP:zES2nMl8gn8oJsjBlYF0iqjdzBnbb/n
- TLSH
  T107722BC79221C807C1FB827B74174AE65F3D8142B0AEB77BA7902E753A1A15C9F85F20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  RedWing-Panel-main/source/decom/stealer_smali/lib/arm64-v8a/libcoremod.so
- Size 98KB
- SHA256 089d6586585521b5bb902b0bd828685e1ae9d16a7eb587b35536fb60be9f7015
- MD5 91b47e379f760a8a88c1945b7424cf75
- SHA1 6744dbcdd18988662fbe4e0892be8603fc783ce1
- SHA512 6bd04fc66f8ff94b7e238a2b1e27875fca556a7f7bab21a00f8349b3fd69fccf86b58487a1e16d45a7b5dfa627ae9d7b6952aeb5de5eab3ece706af41bc93efd
- SSDEEP 1536:uVm2Th1Vv0u5Y5Bs74EEVIDYTVkfjvM7QouamgV/0v5RdohF0PSSoeWOiKl4UwH:l2N1VvMwMu9gV/0v5RKhF0PME
- TLSH
  T194A3FB0A921C5433F2EAB2FC2C194562FC3334929667EE5277F2510EED6B1D2CE26635
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21 behavioral22 behavioral23
- Target
  RedWing-Panel-main/source/internal/api/antichernukha.go
- Size 7KB
- SHA256 2a37f506c271793bf37c7789374c93301c9af5d21995251abf8be55b089351e9
- MD5 8eb0bbfe27fa10651159dc601c784282
- SHA1 db8fda78debf811965ee213e68df9ee8926f99b3
- SHA512 ddeffbfcc8f51023e8ab9e8bb714d4af8cae5b28097ff5144f9c10632cb0508d1921a01a54aa612d81be755807a21b6d49a0426353ab9290f52cd1635ab8446c
- SSDEEP 96:YB/i5FhcKk0g++ywjvvP0peE5g2x+qhyNHUy+yCiEmhOvuiUvqXztFJmG:S/i3V1gvy4PE5PhQ0Fo+uVezdmG
- TLSH
  T19AE16356F3DE643AD90300938CE188C294F5857B257486BAB46CA4EC1F6E6B2C6F3D1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  RedWing-Panel-main/source/internal/api/blast.go
- Size 7KB
- SHA256 848ef2f97a2451f9ec0fd900106726849b60e1087c92b2565f6b27aec8de69f1
- MD5 1ba15683006612d1c28fa07a247cbf75
- SHA1 3e16b487a457bcd1e0e3b90223c3e443236bf400
- SHA512 0f7525b9f36e586110271abb5fd225b9dfa64f898835eccf806d934672e6a21fa73ee37cbba8f7458b3707035ffd6154fd9cfaf41abaeb26d9e5975686b709c0
- SSDEEP 96:lFOjBaEmojJiQCNSv3fcVab8Eeo/KpuDITR7+ITdr/IMhWzXCJzXbnTKsxvDS00z:XQJVCNSgEsnkITdr9hWzSJzLnO2Lk
- TLSH
  T190F16341DBAF04448B4321A45CB444D2D97BCDB378E1ACF3FCE4DADD250976A963C8A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral26 behavioral27
- Target
  RedWing-Panel-main/source/internal/api/commands.go
- Size 8KB
- SHA256 e381468d3d9475ebc790815da59b99ab741131663f037629d01c24e66e4baa16
- MD5 5ab8f2d933b382a799679d5443135f87
- SHA1 3cdd8fbab3af7bc337b87bdfb9187712190817b0
- SHA512 110adf0fd6e99190dcf040e191a0e82da3da34c9bfb42d56cfe902432977733cf57f3ae9f95e39b448cfc4e617547216ebadf1294b1e7b36881fbf3e78632af7
- SSDEEP 96:3IVc25+dRx0/oQxwevVauzXKqSSxf74Lj8dMY2I3Yv9LaXBiJOuYg3Yv9LaXBiJX:EpA4dz/xij8xBMnBM0X2cX9ieR6
- TLSH
  T14D127545AFFC04158E8210948DF4C9A2DCBEE677282664F7FCE8BDCC240DA9AD63D815
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28 behavioral29
- Target
  RedWing-Panel-main/source/internal/api/device.go
- Size 11KB
- SHA256 ec2ffa7d348529eb75b285778e2d020299ac6a9bc88a5a66c026c53757785186
- MD5 c5fa3baa6ae2fe15d0694d98759fd268
- SHA1 f02f3c8e9b1f52a12361afe6677ef5c552f726cb
- SHA512 73ab9d4cf25d70d5792dd02d8bef9b72f069d6cf86d94cb4f3b74a4847420132d57a28bff6fa345a0fab26d8d655aff183e490e2316c1ce495b55438c9964c15
- SSDEEP 96:x0nosmVf0dyCu0kxHBuvvoKqVf+dwo0SENtKyOAyV2YYgz7YkYP8dVf/5S8hbK2u:x0osY3GEHBcwLLNtKKSB11WebcbUdK
- TLSH
  T106329485DBED8801DE830094AC744817DEBBD9A72C7594E7F8ACACC8370EAD6D738465
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  RedWing-Panel-main/source/internal/api/devicedata.go
- Size 7KB
- SHA256 b8e196bb59ee7466f23137dd9ccbe8aa41b2f361fc4352d6f967b243c3d4e0f0
- MD5 d01d136bdf02672fb4b344b8b165852d
- SHA1 67ffcffb2a99e8cca04244b228a32e743d58259d
- SHA512 1f156be4833af29f3bd6cfbd5b772448d5e749e43ac6a6c0377088481dd8979031f7083933a05897bb174703cdcb88199cd32b43583793550bef7b1a928276ad
- SSDEEP 96:PDuz832hFzipU9m+uif/YcLE5iopb3hzi7lU6XIZBPc+1QzF7gxvA:iSK1uyXKzCh4Z1c+SF764
- TLSH
  T102F12381E7DD1812CF5711A08CF48847D8B7D4B738AAE4F2F8D8D4CC6E0E6529B79496
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32