Extracted

Extracted

• • Target

    LisectAVT_2403002A_60.exe

  • Size

    3.1MB

  • MD5

    6bd4c51e4031c7c52f317c7f0ce6fe82

  • SHA1

    8fcea7b4943f220bae3abf2bd6f2e743e4c8ce22

  • SHA256

    19692cac2951c941e251f500f458a5b14d064784539924479ea4b2ec8c2de0f0

  • SHA512

    45f706006c30b768c2a87eee6e552b6f04102cde0372492143da75ffe5d03e447a25ec7b142cf1e7f6961e96f913954f924081d8c110c3087f9709c2ab2c8d82

  • SSDEEP

    98304:0dNIA2b8lIpIta0Icq+KPtYulORjiCSHwdlPtqM7RcS4FIKU21IEfrNdSf8:0dNB4ianUstYuUR2CSHsVP8

  Score

  10^/10

  azorultnetwirebotnetdefense_evasiondiscoveryinfostealerratstealertrojanupx

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2