Extracted

• • Target

    P.O-00490585693.pdf.exe

  • Size

    570KB

  • MD5

    d9d9b12977e4df98046692a0a47d4ca9

  • SHA1

    2d5c0fbf770c944443d52a2b0088e9077001838d

  • SHA256

    7ca2e77373e52431f89441df57949f8ed73f5d3cf5873f964b4c00446770d5fe

  • SHA512

    f055dfd784ff1e346d6a4fa759f0e38b1fb80c8086f9b306c7b53eb14e7e2af627fe41eee892d1e5cf2a7f3a2e2801dfbad5fcadf1b69a1b3e56daa505573d0f

  Score

  10^/10

  hiveratcollectionratstealer

  • HiveRAT

    HiveRAT is an improved version of FirebirdRAT with various capabilities.

    ratstealerhiverat

  • HiveRAT Payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2