Extracted

• • Target

    G K M 9 5.rar

  • Size

    9.6MB

  • MD5

    39eaf06aff90c74b0fb6b2d98c939f6f

  • SHA1

    48af9760de8234c93d7f7b2af5d429950ece6190

  • SHA256

    314166f9dde25b13c5cca86e65a67b26dbae5dcf17dccf7c5a5eb21d3ff76316

  • SHA512

    69aabefdf3438a004b49ee0ec04571d072e7e2df93b1925e997e25d8cc25c02fa960d025bf1cdcddf428437835f6a75f8d50c7dc5420ea61a7571bfbd628696c

  • SSDEEP

    196608:+9D+lduWOcYQXeOVzkB9ASy6rSniS6SAxAm4y5G/VqMpb7LS8D8nY:+AEctXvVzkB9xyESQhfPw/wY

  Score

  10^/10

  redlinediscoveryinfostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    G K M 9 5/Client.config

  • Size

    33.0MB

  • MD5

    157bca5bfbab154797fbbe947946084f

  • SHA1

    280096391abd2ea592198d205b6e44cdd2408121

  • SHA256

    f9aae2ca83d60ae3a6e443d23c91672cda766f73003e4f3f0f99eec1f336d946

  • SHA512

    5fbbaa59d4425779ecae554372a476414a60b70fe190ca408a0505b13064866d1576e6409e657d2933cd5922a053aacdf7c01b457b3385476dabfe1c46b5c1da

  • SSDEEP

    786432:BeCve2OlHAoFfgrh96BKMZvBx9ImCrWFi6:BejjlHAopI9xABx9ErWFi6

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    G K M 9 5/GTA 5 Mod Menu.exe

  • Size

    312KB

  • MD5

    46796db8acd3ff52d5daa757a0acc12d

  • SHA1

    090afe3863790f1e8d9420309538aa5fa846b29d

  • SHA256

    b38f4158c414aace2b77f2743822d2b05b1b456f4b339192c48804fdae25a184

  • SHA512

    5b3647b1f2963177513f5a336563e3a8563fe4e6d1c8e00ad4e554f298fca03c200f99a384b24672daed897bed9eef15442dd99afacd5e9992dd27d053f151bb

  • SSDEEP

    6144:z6Tz42be3YdQ69bI3aG7ziKyTcQsH9nw5DIOoUX+WXvC1OELkRue:x2YYdxbjPKyTBsFUMJUXf5ELkRue

  Score

  10^/10

  discoveryredlineinfostealerspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral5behavioral6

• • Target

    G K M 9 5/ai.cfg

  • Size

    44B

  • MD5

    73ed0e22c8cc70ed93dfd0c1b8f81e19

  • SHA1

    f16c87ca3eb393ee34f57fb59781cd37f5963db0

  • SHA256

    db9ec7ae21d140904d44d6e6550c0c964e32ef11c055696b355835905c9c3a53

  • SHA512

    3dbe1fd660c7446c4a70c99cf6bf7909c76cd02ca24930bdeee851da094850b2fd6f6742025d215ce7dbf3348225c0b64d28e3f1ba133bdd9c7beece84d7e54f

  Score

  3^/10

  discovery
  behavioral7behavioral8

• • Target

    G K M 9 5/cacert.pem

  • Size

    2KB

  • MD5

    39f89143815797c4a41c62f30f137094

  • SHA1

    39a602c37ee958e5a5779c167ea095a56f0218e4

  • SHA256

    5513aa54afe134569e08b27aa61e60e888ab31d9e112f8c5881adbaecc817678

  • SHA512

    02cfee4a3fdc728e63e5a63797c58c5a6fbd805f6f6e5c0ab4e5dbf1d1701636a6aefc94095096b627b7475e731327d620c519ddc1a65b3ee49dd41b4d219d6d

  Score

  3^/10

  discovery
  behavioral10behavioral9

• • Target

    G K M 9 5/config.vdf

  • Size

    14KB

  • MD5

    bb23e26ed15c9951460513efdb0b7ac7

  • SHA1

    41e15b1f30840160ea095f0f415ac3afd6d06968

  • SHA256

    9fce8b4ac41455418615f2785199f72d7fe6ce39d8cd9182027a752c4f26d04a

  • SHA512

    f3f3e7ef4765520554fcb523b43f448b28b29fbbf150657728084b720fca4568a23a3846f37f3c57b6710fdeb3761fecc190f468944ba1a687aad0e8f7af1093

  • SSDEEP

    96:o9lCt/5KFdRBQ20LPr7U8Op3y47Zu/ZqaJOTFogkU:o9MtBKFdRBQ20LPr7U8OBlsRq8gkU

  Score

  3^/10

  discovery
  behavioral11behavioral12