Extracted

Extracted

Extracted

• • Target

    f80bd53a58316d8fb43c24725c923ff2.exe

  • Size

    4.1MB

  • MD5

    f80bd53a58316d8fb43c24725c923ff2

  • SHA1

    45c116a5e5e1680c47dd01605aa5d5033b436162

  • SHA256

    e844192fb4c52758db729e18e8898fe0921bdbe1e2d3ac3da6a6b5d2cedecb71

  • SHA512

    3a0f0dcba8a4cbe3a9185f8965a9201e0fdfd0179fb374fbb590bfb717d71ad6a102a890322ba69447bb7ba16f6dd583af9a92c673cb34a2ddef21876ecd3634

  • SSDEEP

    98304:FzEls77BGpj21HbwiWDO7PLgJSZdhmrJcgltWjW6ftjkn/0L4yGZ//2LXWAgUq:F17tGKHbIDO7DMorOqglAj3Sq4P2LmxU

  Score

  10^/10

  nanocorequasarwarzoneratslaveevasioninfostealerkeyloggerpersistenceratspywarestealertrojan

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2