Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target
    Red-Flaged/4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88.exe
  • Size 6.8MB
  • SHA256 4ffb7cec59276bc2e1fcbdf462b23fbfda1ebae6b0d388dbaaeed6a0cc706f88
  • MD5 ab3ea47e165ee24fa664a8133135aa23
  • SHA1 abc5806553b502a97124c06eabc1eff372c33525
  • SHA512 33ffac15adcf1b5147ea644b7d327005b3a9e85d2d55a2b5bfe7b07bbe258e8e037bff9b2958b4c643c929fe5087136bc1509881a9de615d21cf46b175486ff3
  • SSDEEP 196608:F0CAmWMg4pCea/iXaHH+uebdJjjEsYvBsAQLIttA:F0FmWMx6iqHWdJ0seHo
  • TLSH
    T1BD7633EEE17ED6E8F9746AB97C2EB0401026CF1A4F51C9C1B163B79A5F8340491DE293
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionimminentxmrigminerpersistencespywaretrojanupx

  • Family: Imminent RAT

    Remote-access trojan based on Imminent Monitor remote admin software.

    trojanspywareimminent

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    Red-Flaged/51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2.exe
  • Size 14.2MB
  • SHA256 51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2
  • MD5 adf675ffc1acb357f2d9f1a94e016f52
  • SHA1 2cd15d5d4cc58d06cfb6be5eabc681925d0ce5ce
  • SHA512 595728b9cda47b59abcb9145da8f3101223d87dbd3d372db4688afd236b81a611cefa2cf268ce22b5a968a2bd118f83a505673c041aca558cec2bb5f0abcea44
  • SSDEEP 196608:0aXETABIUswT55RNYi9t4M/ovDL8j7askQSrR2vPJzsb20RQbJxF9:0oBI6vRyihUY7atHYvPZZR9
  • TLSH
    T11DE623D67ED51354C0C78E60938B275DB1E1B7CF89AB583E37CA0C066630E97824AE67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  gentlemenransomware

  • Detects Gentlemen Ransomware Windows version

    ransomware

  • Family: Gentlemen

    Gentlemen is a ransomware written in Golang.

    ransomwaregentlemen

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4
• • Target
    Red-Flaged/53fb999c4ef195a5c37e80ad4208f7d3bd02951672462339cafd5c0463a6f2aa.exe
  • Size 6.6MB
  • SHA256 53fb999c4ef195a5c37e80ad4208f7d3bd02951672462339cafd5c0463a6f2aa
  • MD5 01074b4b4c51e926159bfae3c3f90b32
  • SHA1 53b9864c00900ec47a5c244ca954e9f64525bc04
  • SHA512 9756b3b6619aeb49f39e43502b40082af82a47f656d37f90bf0a20cb42bd46c84a9549ecc7366f3e9a421a6d54d1bce3703fed09a46a303840fb52da073d4511
  • SSDEEP 98304:wcMqqwwfChDLTPwwuRsbtdR0yLDRiweqYbJ0Ldlz3cY:NvwsTPRwceyLliJ0LdlLcY
  • TLSH
    T18B66DFC19BE767AAC9ECE5B491B0BDBC8B3F99610C15B49DC2836D633201F1C93536A4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryasyncratstormkittyratstealer

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral5behavioral6
• • Target
    Red-Flaged/556eaf27dd7c9d5b1949766151b83035625e11dabcfe0259f7a927fb80f0145e.exe
  • Size 1.8MB
  • SHA256 556eaf27dd7c9d5b1949766151b83035625e11dabcfe0259f7a927fb80f0145e
  • MD5 142fb17b0d86d3743a241853d51c582a
  • SHA1 5c8104ff79a0164622a87167454a48554650a696
  • SHA512 80a1a6813057837810186443da13efe55c36923739bdd0ffc0cb035757175712cfb515e878c2ee1371611b89046ebeef292e4d83fd688269ae5f5fdc31d267d2
  • SSDEEP 49152:2Rzkrv27zfqd/avc42U2LjLD1QgnHW1iwvYB4Ii:2Vkrv2fhsRvD1QGQin4I
  • TLSH
    T14C85339CCA76E6B9D47F02B96886FD0D0AF12F9171C90551B30D23338FA765E4A3942E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverylummastealer

  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral7behavioral8
• • Target
    Red-Flaged/55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af.bin.exe
  • Size 754KB
  • SHA256 55baad005084e7c41a43ec92fd37d3b05eec2a528b313c2cac252859db7a56af
  • MD5 c0be91bfec41194304957e8b39c04687
  • SHA1 c91d161e8ef176025434302a909271e7c0db36b6
  • SHA512 5156ccacb7b6b670a7abf4ac56c4ff0900b5a8a07b8e2647673b57e24f392d83ffa54744a1f22bda3fd400296c1e55669e42845efa4934a6d764b72ffe41b0e8
  • SSDEEP 12288:cXzeHQl0b2hO0RXOqmDxmFFqr+H0MMcOgk56k8eS4PMi1ncSDq:k6HQKbMh6DxEFq6UTakYY90sncSDq
  • TLSH
    T1AEF42317F39A39E1DA36CE3C466A552A87FEFC3415A0EF36296020551E1C602EF3ED46
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  nighthawkhacktool

  • Detects Nighthawk C2 framework loader

  • Family: Nighthawk

    Nighthawk is a C2 framework.

    hacktoolnighthawk
  behavioral10behavioral9
• • Target
    Red-Flaged/57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3.exe
  • Size 1.1MB
  • SHA256 57752262d1f2b530fa014b31fe3d836f47d0b8ebcc81e275a9bf173b42f808a3
  • MD5 3655d9ae7e7c163a060151ddd2ffe16c
  • SHA1 808e5f026d93a25c3651c95b55f9ebda880bb796
  • SHA512 f6fb3a21056e63251704eef694246340f1cd9c58c1059fd1f68a0d4c4492c0dcee0e6ad357b12793ee4afb7ef1f6c50feb5d2a837d09437a1400bfd086e6c6a5
  • SSDEEP 12288:+vYeGGASYfVsFlEIU+0O2LFAJHm9YqIUUyRgVVpfcqPSTCesaJYM0JiogUbD8S3m:+2Opxv+FAAyqyZQBsaJYMoQU
  • TLSH
    T1E03505B026D63A05E43A07F4BB49857C437B4D4A5829CB47CD95E8EB3DA3B97060CA73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionagentteslakeyloggerpersistencespywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • SmartAssembly .NET packer

    Detects SmartAssembly .NET packer.

  • Suspicious use of SetThreadContext

  behavioral11behavioral12
• • Target
    Red-Flaged/57f7bfb5b37364563c03ed29228a43e44936edb4ea1f232b6c74c2ecd06cce1d.exe
  • Size 3.9MB
  • SHA256 57f7bfb5b37364563c03ed29228a43e44936edb4ea1f232b6c74c2ecd06cce1d
  • MD5 f392807da3ee1f3e9702ce5fa91d418d
  • SHA1 267c2e01edebdccd5387bfa6def2255d3f239b48
  • SHA512 151a823fe8f99a22faf1d2d7c0de10694462714e1debf27d360e23fc21ea39c9ab966d05a7e7db3f2fca52239b5a281a8cbdb51f8e07e9796ebb525aa76e190c
  • SSDEEP 49152:LV2AFmNiANYarb/TjvO90d7HjmAFd4A64nsfJNoY6Mh/+saMFWSQ2zIVl+5EB3AZ:lANK6M/DEB3u23Y
  • TLSH
    T1FE163907F89540A8C4AED230CA6A5252BB717C981B3463D33B64F7B82F72BD45EB9354
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionblacklockransomware

  • Family: BlackLock

    BlackLock is a Windows ransomware written in Golang.

    ransomwareblacklock

  • Deletes itself

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral13behavioral14
• • Target
    Red-Flaged/5a765351046fea1490d20f25.exe
  • Size 377KB
  • SHA256 e9cfb6eb3a77cd6ea162cf4cb131b5f6ad2a679c0ba9757d718c2f9265a9668f
  • MD5 1c234a8879840da21f197b2608a164c9
  • SHA1 ed7f6d70968fed5cf59ed2a141fca928e1b0522f
  • SHA512 4d1e82700307cb87196554c459e0b36966f454777876a80a929977ede6d73230611bd0424a57cd0e5f11183b4b13d0e5549830a9effe467b644fa1ddcfc940f2
  • SSDEEP 6144:IHDNS5okyd+3xOFd0RM9910Qo50yuuJGmdmESvhI3BoUw0h8vIkUm4ggfsJWr:gS5bA+3xOFOG9P6buG7m5gRwJXU/
  • TLSH
    T11384235C3362729CD0F6FAB067511462BB8092AD4B68C5C6CA5B533E5E2D2D7EA010FF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionazorultinfostealertrojanupx

  • Family: Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral15behavioral16
• • Target
    Red-Flaged/5ec9325b6998e8749bc0465890f201e3d8fddb767b2eeebb4f84fd7cf942930a.exe
  • Size 84KB
  • SHA256 5ec9325b6998e8749bc0465890f201e3d8fddb767b2eeebb4f84fd7cf942930a
  • MD5 f53b7572e05fec48d9f884ca749ceb23
  • SHA1 973a09ecb5c34bef20337520a2a2acd8f00a7cd4
  • SHA512 fc4410990fa3a61b046693596a1fb9cad1d3100f58c99fb112a666d1c379d023ac026a5ad6c617730120c71d2f7d76e4d47c06f6e2017df8b538751313e1bc3a
  • SSDEEP 1536:Id3zopNXvHsd3p+TR9bXKXSREXHfVPfMVwNKT1iqWUPGc4T7VL/:ooN/HsdZ+TR9bKCREXdXNKT1ntPG9pr
  • TLSH
    T1D1834B8B63CD0F7EC58F03FAEB1645D6A7AA51361364F3A0605F932C22D2A7D457A284
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryberbewpersistence

  • Adds autorun key to be loaded by Explorer.exe on startup

    persistence

  • Family: Berbew

    Berbew is a backdoor written in C++.

    backdoorberbew

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral17behavioral18
• • Target
    Red-Flaged/6377d2686feb3c4b20e53085a379e9d2381adeaafc698f56373c1548a74a6fa1.exe
  • Size 1.4MB
  • SHA256 6377d2686feb3c4b20e53085a379e9d2381adeaafc698f56373c1548a74a6fa1
  • MD5 b48419bb4a0fad2853243d744fc9dca5
  • SHA1 991802684cc29a9b0742d0521e2a8485d409eef2
  • SHA512 92be1c65d63a5164c6f91e1abf8069298ecaac84d4111d19bd91b35383e638ebc3066e666808fd961695d3a340bcabf4d1e40f65dd84f9b59a3785a9419fb1a0
  • SSDEEP 24576:faMoNmfTEs86C9r5m84DVTh22rFvGf9VLegQEollG4uXpeTR6h:f0NeEs86FvMLejlG4uYK
  • TLSH
    T171659E27E9C180F2C198107168AB1F35FEB456912E358B83A7D4EEB85F72790DA3721D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutionflyagent

  • Detects FlyAgent Backdoor

  • Family: FlyAgent

    FlyAgent is a backdoor written in C++.

    backdoorflyagent

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral19behavioral20
• • Target
    Red-Flaged/6669cfeba5619b6f4d80b1281adfe69c87d845ebaaf9e83c25efa01a8267e751.exe
  • Size 3.3MB
  • SHA256 6669cfeba5619b6f4d80b1281adfe69c87d845ebaaf9e83c25efa01a8267e751
  • MD5 b7e0af5dbb170d91c63b700d8b324203
  • SHA1 6b249c9bffd3698a3033a4110e387a711c488154
  • SHA512 25d609cd98409e1e6298329ec8d3030ec035ee1dbb3750739ec5736d04adfdbfc58575e03c7d32643bf5b118ed33b0a33a48b9a25449540bcb6ec0335cadbf2e
  • SSDEEP 49152:l4wDeyVeECuIhRjp1bj5MDau+4w38wRTuWKd:x5AbFgau+4QJuW
  • TLSH
    T15CF57C27E6A380DDC57BC130432B9273B571BC5A12753A6E2B64EB291F71F60462EF24
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionsarcomaransomware

  • Family: Sarcoma

    Sarcoma is a ransomware that has been active since 2025.

    ransomwaresarcoma

  • Renames multiple (160) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes itself

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops desktop.ini file(s)

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral21behavioral22
• • Target
    Red-Flaged/680a883430e5955b4349ad21e23fc330e74f7c05e1d61ffd25c9970acd303677.exe
  • Size 5.0MB
  • SHA256 680a883430e5955b4349ad21e23fc330e74f7c05e1d61ffd25c9970acd303677
  • MD5 96f110f267773a1cc847202ecdb8a716
  • SHA1 4b523cced78574a6d2be43f1ec62173a5a31f8d1
  • SHA512 28fb69e6653cdbfc1811d547963fa013dcaea0a4e7e700a1c2ce3f313932ecfb6c81b72fba4dc122d8e96c8f4dcc2a28881fe71c686707ac124fc2ed0f0a2787
  • SSDEEP 49152:zcWfr4LreeTFOH/qD/PxUkQ8Z+6wU3CQg7sFnkm45XePkDvbVayZHRd5GezetYBX:QJLrBIH/MLB3CB7sFnwucjGeIjF
  • TLSH
    T1FF36F0026DA343B2DD1E36FD705D233599F05D4F0F2095A62FE7EA64CB2D140AA26D2B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryevasionvalleyrat_s2trojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral23behavioral24
• • Target
    Red-Flaged/7335e618043645e7e6c72d24d2ea3a286b8cbddc1afedf963630ab4f24d95782.exe
  • Size 6.0MB
  • SHA256 7335e618043645e7e6c72d24d2ea3a286b8cbddc1afedf963630ab4f24d95782
  • MD5 2a799ac9f899dedc97a3016b646650b8
  • SHA1 9437f82eebbdcb324634f0e9ea9afc3546ce1992
  • SHA512 462e933aa7fd8c3b0889d3037bf272b12f09357ba69cd3cf0365b92ce7bb9a825f4659ea906331f734893fea7dbe9d2e38cd945406629b5390a7f6f0334db35c
  • SSDEEP 98304:soO7KtDcE19x6MILIyb5smU1ybUqcnqKcqKkadYB5:sKtDjmQnBcBkadYr
  • TLSH
    T18E56AF23B288553BD0671F3A58279694993F7B202A25DC8F7BFC098C4F376406E26797
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverymispadustealer

  • Detects Mispadu

  • Family: Mispadu

    Mispadu is a stealer written in Delphi.

    stealermispadu

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  behavioral25behavioral26
• • Target
    Red-Flaged/85699c7180ad77f2ede0b15862bb7b51ad9df0478ed394866ac7fa9362bf5683.exe
  • Size 165KB
  • SHA256 85699c7180ad77f2ede0b15862bb7b51ad9df0478ed394866ac7fa9362bf5683
  • MD5 b47cdcdc179c5949ce18f4d161603901
  • SHA1 5ef327b0154f7936ec185135a589fe2e19298d6f
  • SHA512 64decfc8515217f8b9801d2b391b4be4aaea6d910f5110543ffc3a566a0c3064cc95b354977ab9e523b69afef7af4027edcc991bcda6ae374a09f362e22952b1
  • SSDEEP 3072:LSv9dtA6pzarOLgSua/iw6kzgYPoCGMlIlBxpNcVN0Eju560LFWwKErV089ue2gZ:LUDoCGnlBxpNcVLQLFW1ErWQd280X+Lj
  • TLSH
    T1BBF38C58B3D08075E577183209F09AF5A97EBC301F11ADDBBB8047766E21AD39634B2B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoverylynxransomwarestealer

  • Family: Lynx

    Lynx is a Windows ransomware which operates using a ransomware-as-a-service model.

    ransomwarelynx

  • Renames multiple (302) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral27behavioral28
• • Target
    Red-Flaged/885ef9a1ef4ae7b212628622f6b72e29381a8c8bb5abf667e7da6f537493a0be.exe
  • Size 3.8MB
  • SHA256 885ef9a1ef4ae7b212628622f6b72e29381a8c8bb5abf667e7da6f537493a0be
  • MD5 7acc97d6145bff3ac21bef160336ac80
  • SHA1 30302ca128637056d6bd7a95503cc9ef92dc4bae
  • SHA512 9dcf6440b6cb577d3d97a97929a69a7a78266455a6a0ebb50e2bf9517d94c299bab60701524d1352c2e76aff132ec5609cdef3a09c4e49bdffe961988d3046d0
  • SSDEEP 98304:afahFTi/plbVT+JTmQwOiK4doj9ghi1RebMIg9Cbk/VF:aCPTMywOiKyojDIg9Cbk/VF
  • TLSH
    T14606D031BCD9D0F6D46322364A9D7364A19EFE70363A0A0735553F2EBAB1242A51CE73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  07 inry novdiscoveryasyncratpersistencerat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • HeartCrypt Windows executable packer

    HeartCrypt is a packer-as-a-service (PaaS) that injects malicious code into otherwise legitimate binaries

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral29behavioral30
• • Target
    Red-Flaged/8e9a8026a844ae290cfe223e820894324bc2eb12339c04091d97fcdc227fd1f6.exe
  • Size 428KB
  • SHA256 8e9a8026a844ae290cfe223e820894324bc2eb12339c04091d97fcdc227fd1f6
  • MD5 e4e3f62b67ac3e972ebccf894fc191a0
  • SHA1 ab09bd849f712502fad28e2188e5da908e14041a
  • SHA512 9a465fcff0be5ab76501e949caa6fbc37194f92a0c13113482052e17134604b4b24bf1b616db59ff934a505b588da5fdd4810715e09bdbd54bf5e5ff29267725
  • SSDEEP 6144:cDKW1Lgbdl0TBBvjc/TLDh6gA3QBsaGWQLU2YAwGxai7MXBr:Kh1Lk70Tnvjcr3i38GFQB33ic1
  • TLSH
    T19F94CF24B5D0C472C1A6023489E5CB756B3A7C614B6682C3B7DC2FAB7E313D667352CA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  panta_logsdiscoveryredlineinfostealer

  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  behavioral31behavioral32