Extracted

• • Target
    5e666dd322071cb3a929e02610809e8a19b040bdc4487a72cc4d6adf03c452d4
  • Size 1.3MB
  • SHA256 5e666dd322071cb3a929e02610809e8a19b040bdc4487a72cc4d6adf03c452d4
  • MD5 f7c87ba8f8cdc3d7559743f79c77d48d
  • SHA1 748e9c38aa1165ddd27f260cb8d9640dbd1107dc
  • SHA512 d655800e9f6f6af10e7bfbaa53f3b25b864e4a700cf56d61a8ef804c991a0c90477907688e8ba79b1622d04b14c80925ca077ff62f064b33028db2654f934ca1
  • MD5 SHA1 SHA512

  Score

  10^/10

  netwirewarzoneratbotnetinfostealerratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • autoit_exe

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2