Extracted

• • Target
    e6467917f8ba730b9d20d4df66e1fdef1cfbacd2cfd6e15cacbf4374a3ef114e
  • Size 1.3MB
  • SHA256 e6467917f8ba730b9d20d4df66e1fdef1cfbacd2cfd6e15cacbf4374a3ef114e
  • MD5 0532d7e6836d7e96036ed4b01c279d4d
  • SHA1 8b5d197f852035cc588d97017a6136a5bf826ae9
  • SHA512 146b9d7c841a6e4dc1baa4105eefeb4af267c374ccba50a7a6e4d15be8b76acfd1c44db8e99f09ea880d5fd31da9889fe25fc8d2a0f4a86a8b21ed5f07a0dbbf
  • MD5 SHA1 SHA512

  Score

  10^/10

  netwirewarzoneratbotnetinfostealerratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2