Extracted

Extracted

• • Target

    Order Sample.exe

  • Size

    548KB

  • MD5

    019959ee5ce020ae98d3936096ac5236

  • SHA1

    748d678080173daebbd8e41858b38b67bcfbc462

  • SHA256

    55f6e402d458c2d35fca88a85bc8891d997730198cdfea1313bb66c3107394aa

  • SHA512

    c4998b282f57e653d4f43764dac8ea48995c8e08313e9bfc00651adb615cf719ce965ed9d88a311a2aaab820e51221c8171c3761d9ccf960f4cfb3fc11446e79

  Score

  10^/10

  nanocorewarzoneratevasioninfostealerkeyloggerpersistenceratspywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2