Overview
overview
10Static
static
5RedWing-Pa...server
ubuntu-18.04-amd64
3RedWing-Pa...er.exe
windows10-2004-x64
1RedWing-Pa...er.exe
windows11-ltsc_2024-x64
1RedWing-Pa...nux.sh
ubuntu-18.04-amd64
7RedWing-Pa...nux.sh
debian-9-armhf
4RedWing-Pa...nux.sh
debian-9-mips
3RedWing-Pa...nux.sh
debian-9-mipsel
3RedWing-Pa...ws.bat
windows10-2004-x64
10RedWing-Pa...ws.bat
windows11-ltsc_2024-x64
10RedWing-Pa...une.so
ubuntu-18.04-amd64
RedWing-Pa...une.so
debian-9-armhf
RedWing-Pa...une.so
debian-9-mips
RedWing-Pa...une.so
debian-9-mipsel
RedWing-Pa...une.so
debian-12-armhf
1RedWing-Pa...kgj.so
ubuntu-18.04-amd64
RedWing-Pa...kgj.so
debian-9-armhf
RedWing-Pa...kgj.so
debian-9-mips
RedWing-Pa...kgj.so
debian-9-mipsel
RedWing-Pa...kgj.so
debian-12-armhf
1RedWing-Pa...mod.so
ubuntu-18.04-amd64
RedWing-Pa...mod.so
debian-9-armhf
RedWing-Pa...mod.so
debian-9-mips
RedWing-Pa...mod.so
debian-9-mipsel
RedWing-Pa...kha.js
windows10-2004-x64
3RedWing-Pa...kha.js
windows11-ltsc_2024-x64
3RedWing-Pa...ast.js
windows10-2004-x64
3RedWing-Pa...ast.js
windows11-ltsc_2024-x64
3RedWing-Pa...nds.js
windows10-2004-x64
3RedWing-Pa...nds.js
windows11-ltsc_2024-x64
3RedWing-Pa...ice.js
windows10-2004-x64
3RedWing-Pa...ice.js
windows11-ltsc_2024-x64
3RedWing-Pa...ata.js
windows10-2004-x64
3Analysis
- max time kernel
120s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
21/08/2026, 02:59
Static task
static1
Behavioral task
behavioral1
Sample
RedWing-Panel-main/bin/linux/server
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
RedWing-Panel-main/bin/windows/server.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
RedWing-Panel-main/bin/windows/server.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral4
Sample
RedWing-Panel-main/install-linux.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral5
Sample
RedWing-Panel-main/install-linux.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral6
Sample
RedWing-Panel-main/install-linux.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral7
Sample
RedWing-Panel-main/install-linux.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral8
Sample
RedWing-Panel-main/install-windows.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
RedWing-Panel-main/install-windows.bat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral10
Sample
RedWing-Panel-main/source/decom/apk_smali/lib/arm64-v8a/libcputune.so
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral11
Sample
RedWing-Panel-main/source/decom/apk_smali/lib/arm64-v8a/libcputune.so
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral12
Sample
RedWing-Panel-main/source/decom/apk_smali/lib/arm64-v8a/libcputune.so
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral13
Sample
RedWing-Panel-main/source/decom/apk_smali/lib/arm64-v8a/libcputune.so
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral14
Sample
RedWing-Panel-main/source/decom/apk_smali/lib/armeabi-v7a/libcputune.so
Resource
debian12-armhf-20260513-en
debian-12-armhf
Behavioral task
behavioral15
Sample
RedWing-Panel-main/source/decom/dropper_smali/lib/arm64-v8a/libxoafgxkgj.so
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral16
Sample
RedWing-Panel-main/source/decom/dropper_smali/lib/arm64-v8a/libxoafgxkgj.so
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral17
Sample
RedWing-Panel-main/source/decom/dropper_smali/lib/arm64-v8a/libxoafgxkgj.so
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral18
Sample
RedWing-Panel-main/source/decom/dropper_smali/lib/arm64-v8a/libxoafgxkgj.so
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral19
Sample
RedWing-Panel-main/source/decom/dropper_smali/lib/armeabi-v7a/libxoafgxkgj.so
Resource
debian12-armhf-20260127-en
debian-12-armhf
Behavioral task
behavioral20
Sample
RedWing-Panel-main/source/decom/stealer_smali/lib/arm64-v8a/libcoremod.so
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral21
Sample
RedWing-Panel-main/source/decom/stealer_smali/lib/arm64-v8a/libcoremod.so
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral22
Sample
RedWing-Panel-main/source/decom/stealer_smali/lib/arm64-v8a/libcoremod.so
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral23
Sample
RedWing-Panel-main/source/decom/stealer_smali/lib/arm64-v8a/libcoremod.so
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral24
Sample
RedWing-Panel-main/source/internal/api/antichernukha.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
RedWing-Panel-main/source/internal/api/antichernukha.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral26
Sample
RedWing-Panel-main/source/internal/api/blast.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
RedWing-Panel-main/source/internal/api/blast.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral28
Sample
RedWing-Panel-main/source/internal/api/commands.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
RedWing-Panel-main/source/internal/api/commands.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral30
Sample
RedWing-Panel-main/source/internal/api/device.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
RedWing-Panel-main/source/internal/api/device.js
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral32
Sample
RedWing-Panel-main/source/internal/api/devicedata.js
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target RedWing-Panel-main/bin/linux/server
- Size 11.6MB
- Sample260821-dg65da1gla
- SHA256 a7ccd070b9dfc7f3c6fd079e81745203c68d5d95d39f53262ed1888bc1daa770
- MD5 6dc755e006f2bce731f94970df2662a9
- SHA1 46c38c1fa33cf02c1c4a0ea70138446db7825643
- SHA512 c6acfffcf952d52622bf5ad5e8335cb29286466d38bcd208a4c16b78cf1d8fdbb7e536439f6ae479d09f5b63ff56f626156fbdc24db4992781b58ab76bb2691f
- SSDEEP 98304:j55ngVfEEEKx5bNME1mN0nt2oaoKsC4vDTqktvGnEeZ:j8O/NIYo1VD9GEeZ
- TLSH T1B6C63947FCA545E4C0AE8176C6629663BB713C894B3033D36B50FA282F77BD0A9B9750
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size server File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us server File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us server -
description ioc Process File opened for reading /proc/self/cgroup server File opened for reading /proc/self/mountinfo server File opened for reading /proc/sys/net/core/somaxconn server - Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/RedWing-Panel-main/bin/linux/data/redwing.db server File opened for modification /tmp/RedWing-Panel-main/bin/linux/data/redwing.db-journal server File opened for modification /tmp/RedWing-Panel-main/bin/linux/data/redwing.db-wal server File opened for modification /tmp/RedWing-Panel-main/bin/linux/data/redwing.db-shm server
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/RedWing-Panel-main/bin/linux/data/redwing.db
- Size 4KB
- SHA256 da63a52bdf62b3fc863995d79f497584be3ba97c1de4c55d1d301afbafab6cfc
- MD5 92ca0d14cd0b699cab9d9551be951fa8
- SHA1 d83570f11fb5e5f323b7d8d0d0bbd8299b893d23
- SHA512 f839af7a748c2b9f56113c71f2d90932583bc6c12154bfea05bb55132241906a8f32e4e97c3b2f3ee32614dae78c47f19865a444c28bc1076847c85731525fb8
- TLSH T170810450534000F1D05407F354D1131C1F07F1D4DF510F0315010441CC41544CC70FCC
- MD5 SHA1 SHA512 TLSH