Extracted

• • Target
    5e703b826e5eee3224c5dbb302cf6614305081b15f306b15c7859d3b01d711d2
  • Size 1.3MB
  • SHA256 5e703b826e5eee3224c5dbb302cf6614305081b15f306b15c7859d3b01d711d2
  • MD5 3e7104680f97799c4b4ce6fed9c37887
  • SHA1 6c7b28fdc2abf04aafca9afe7fbbbb0c28a53a1e
  • SHA512 a37e3015d86b9201fa4bc3917114a94d5e7c56ab23999c37b1240b18d62dab8f81e6fddb86d72cad7679e187a1d4a742eec40e608caca59c13a5bde9a3d190c0
  • MD5 SHA1 SHA512

  Score

  10^/10

  netwirewarzoneratbotnetinfostealerratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • autoit_exe

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2