Brief analysis of Redaman Banking Malware (v0.6.0.2) Sample

Redaman is a well-known banking malware, discovered around 2015. Recently I have been analyzing a recent version of the malware (0.6.0.2, not sure if latest version, probably one of the newest). This malware uses some interesting tricks probably introduced in these recent versions. In this post I share some notes about the analysis.

• Original Packed Sample: 2b251483ed7705c60ee12b561280a1fc
• Unpacked Sample (dll): 2a298a650b50eb89041548e57d72f726
• Virustotal First Submission: 2019-10-11 10:35:13
• Related links:
• https://research.checkpoint.com/2019/ponys-cc-servers-hidden-inside-the-bitcoin-blockchain/
• https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/
• https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf