Extracted

• • Target
    86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0
  • Size 1.3MB
  • SHA256 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0
  • MD5 07cc9638a63c64754d88cf0d9cd99a78
  • SHA1 21ac6ff4fa45fe785361d1d35db0c7de3c127a1a
  • SHA512 f272d3041ce43efbf1034d4b1d150a7b4ffa690c7160567919c97cf3037226a677206efd471161f69c913dfc7ade8cfba16d2c4d45e3e7de703968bd05f02c1f
  • MD5 SHA1 SHA512

  Score

  10^/10

  netwirewarzoneratbotnetinfostealerratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • autoit_exe

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2