Extracted

Extracted

• • Target

    055977f6e7f47decf7db3c37071ab461

  • Size

    3.1MB

  • MD5

    055977f6e7f47decf7db3c37071ab461

  • SHA1

    2efcdd61638cfe6b23fdd538bd1b98c84afa1f4a

  • SHA256

    4476fe5ef44af31b5d1d99ba564cc6872678a1263bc047e82896eae1ebda70c7

  • SHA512

    ba0af36c488539966e047b1891552b1ba5a74df199075929d2fc1052282453775f60f42bb16437cb9ba91fcee54d31ae8cfb97a5a6c516214da107f8ce34e4ad

  • SSDEEP

    98304:EdNIA2b8lIpIta0Icq+KPtYulORjiCSHwdlPtqM7RcS4FIKU21IEfrNdSf82:EdNB4ianUstYuUR2CSHsVP82

  Score

  10^/10

  azorultnetwirebotnetinfostealerratstealertrojanupx

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2