Extracted

Extracted

• • Target

    NEAS.df99c9b4f8c0ae300a3a69efd49388c0.exe

  • Size

    1.3MB

  • MD5

    df99c9b4f8c0ae300a3a69efd49388c0

  • SHA1

    77210e46912d113f70e297c9f7b810c6fc3bd117

  • SHA256

    b87f0d1450dc2fe57e833c7eb467c171540ba9c7e9bca632cd6864fefb01e0f0

  • SHA512

    6e2bac8bca0e3e75879b21e9b76d345cb5d1fb3eeaabbfecd21dae86d2dae0eb9dfd3c2e9c90773be0b65fa4ed26175f66efc9ba687f43a10e9b78a3e7b5343a

  • SSDEEP

    24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYh:8u0c++OCvkGs9Fa+rd1f26RaYh

  Score

  10^/10

  netwirewarzoneratbotnetinfostealerratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2