Extracted

Extracted

• • Target

    195af8dc175c552280df0d1921bdd17b87a8aa8b4ff2790bc634e442f78ee29e

  • Size

    1.3MB

  • MD5

    9cba4143a2a5299fbb3fef9c8067f083

  • SHA1

    45aee02cd84334d1aa12354531f7dde5eb32c1f6

  • SHA256

    195af8dc175c552280df0d1921bdd17b87a8aa8b4ff2790bc634e442f78ee29e

  • SHA512

    4aabfeeb32c0e70156bc7fae97e921fc33c0baa2cba657e14da5f80b7130ce088684b6f435fc51049f84b1363525d78107fde8ff80522ec77bda590f9dedd1ad

  • SSDEEP

    24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYI:8u0c++OCvkGs9Fa+rd1f26RaYI

  Score

  10^/10

  netwirewarzoneratbotnetdiscoveryinfostealerratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3