Extracted

Extracted

• • Target

    NEAS.95f89cbdd9bd5d81dd4cdb671a9d12c9.exe

  • Size

    1.3MB

  • MD5

    95f89cbdd9bd5d81dd4cdb671a9d12c9

  • SHA1

    8401397d5d4e12d8fe714580237d979f8a142d37

  • SHA256

    dca25d35ee7ac4e3358051e5b14104eb74606ba7eb736774bf9e36ee46856772

  • SHA512

    6d0edb8b01ebabffd7d549eed9330ea6ced8224080565754de740cb24359ed401df25a2c7b4e182784135c6229d91d9a67348d3211142f0c44946533a391104c

  • SSDEEP

    24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYr:8u0c++OCvkGs9Fa+rd1f26RaYr

  Score

  10^/10

  netwirewarzoneratbotnetinfostealerratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2