Extracted

Extracted

• • Target

    Justificante.exe

  • Size

    6KB

  • MD5

    b5226c3f902fcb19239d77b3663233cf

  • SHA1

    0bf7d9523c35bb347d27c547e84b8ba44af3edc4

  • SHA256

    f771114282960678a312fb160481188d0214a056a16904605ad950e39d0ff93d

  • SHA512

    26fa1ab51782127de1c773647ec5d4a02f213a5c45ef64b6b9ca6dfe612de6516387992dc55c8bdb7c3372410578bb388d1d949207902a9ea63bbed872aa903b

  • SSDEEP

    96:r24EMFkg+auTh4+HL92f3QRZZy7PizmKkiNEeXzNtB:rlELEfATZOq4gpB

  Score

  10^/10

  purecrypterwarzoneratcollectiondownloaderinfostealerloaderpersistenceratspywarestealer

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2