Extracted

Extracted

• • Target
    Fn Cheat Cracked/Driver Dump/driver.sys
  • Size 9KB
  • SHA256 3868770ba5ca380250143472ba753cc94f2c7c318eabc29b5eb0c5de55b08024
  • MD5 d28af522ac4c301de527271c2b1b1726
  • SHA1 ee9d28fff7ae8563cd15cbadd4a9aa10c3040390
  • SHA512 d4ad50d1875ba77a164e3166d9a935506234a39240c024c3bed0876c5cdc8b82957d8d707baad8d908da57fc3f3d314a5d378ee229d1add5887a70d8e75c2fdb
  • SSDEEP 192:wgo2gczvWMcwL/89YcZbZuZxkItZVQHkBAkpT:vokbWM7/65ZNGxkHkB7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral1
• • Target
    Fn Cheat Cracked/Driver Dump/mapp.exe
  • Size 143KB
  • SHA256 e7b9b250e62a5b9fbc0e49e7d572c33bc91df667f0d65c8a4e8f3e11762ca61c
  • MD5 98139cee6a27bc7115b7dec0ccc0d56d
  • SHA1 c73c945b4c0666668afc0c56ac9518108b532ce6
  • SHA512 8f6d68688944d4f51aebd9b8a8209e1ffa1e8ce4437c2d4529d0a1f57daaba73689a9af1ae4a254865801662305cfd7eae2117ad482911835c146fbdc3889811
  • SSDEEP 3072:0nQGQ/taw4jXYpdxLc9wNImJTQSaMm5/6fGNv7qObYop3o:eQGIUw4DwkaWlMJ6Zp4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral2behavioral3
• • Target
    Fn Cheat Cracked/fn (1).exe
  • Size 6.1MB
  • SHA256 1cd7a63a349eacea2579932f9fdf40edf2eb57b62b76b18a92c1b7d0c82c81e0
  • MD5 75104ebb7b59d1cee81ee9855b0bfa0c
  • SHA1 122d4239f5e838c40a905bf8ee4270d2e7526367
  • SHA512 d9aebd3fc23ee26e6135b3b1607c2450c2a837aa383c24cd056ad63e1df7a5dfdc072a6f4f3654008d15d81eee339b25fb9e638a27eabf8bd314825a6c96de53
  • SSDEEP 196608:l4wCflR0SjSDiQckcU+PDF/5/ohgY/aULW:l4w86XcU+55AhgYrW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlinexredinglesbackdoordiscoveryinfostealerpersistencespywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Xred family

    xred

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral4behavioral5