Extracted

Extracted

• • Target

    701bd4943357734318ee825bf2c0bec0N

  • Size

    1.4MB

  • MD5

    701bd4943357734318ee825bf2c0bec0

  • SHA1

    e4982db2188c6b44c495bed6f115508248fc6113

  • SHA256

    719fe9d0e6787ec225258d6ad79654cc90fd923f0f402965640efd7c132f3f72

  • SHA512

    d36050907a8bc11fd5709d00a34320e6ca381fd98704244ef2842daec6a336b5fd70b703f1d81a2246d7c4058d62d8e64c016b96d8fe9ed9c08c49e4e44d7b2c

  • SSDEEP

    24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWY6:Fo0c++OCokGs9Fa+rd1f26RNY6

  Score

  10^/10

  netwirewarzoneratbotnetdiscoveryinfostealerratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2