Extracted

• • Target
    673bbba1c0a1b087c5482b1fa3c2d488ca420d7af7cf45f67f3d0a58b402f7c3
  • Size 1.3MB
  • SHA256 673bbba1c0a1b087c5482b1fa3c2d488ca420d7af7cf45f67f3d0a58b402f7c3
  • MD5 f60ed1a40a55781cec425a6407a9cb8a
  • SHA1 15c65da8cbe1e0506832b1cb444b4a1ff4b7a775
  • SHA512 a8b99ccef9d8d9113b02fb30b243b86c15b31808143f778d68146a71e2230ea22f17b9b5b0cd3cf8a1be8edeacb6367b9c7330ce817b72dfb295a86ba3fc361e
  • MD5 SHA1 SHA512

  Score

  10^/10

  netwirewarzoneratbotnetinfostealerratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • autoit_exe

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2