Extracted

Extracted

• • Target

    33f3dcd2887759e1bac37615ea8a60f48a4bdcc2390a88209e30f7fcee433370.exe

  • Size

    1.4MB

  • MD5

    9a2b6f1aedbf159055d6724417210d60

  • SHA1

    2e850215bbe2884efe9d58bcdb848457ddd860fd

  • SHA256

    33f3dcd2887759e1bac37615ea8a60f48a4bdcc2390a88209e30f7fcee433370

  • SHA512

    0a74c5961f6592b12617ec69c324442b66efbb9f892673a3fe22dd1debb6017d18de7ff67c40d2b9cb0c6f0fccbd212575f37263e52d2509849a0c75de33e169

  • SSDEEP

    24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYx:Fo0c++OCokGs9Fa+rd1f26RNYx

  Score

  10^/10

  netwirewarzoneratbotnetdiscoveryinfostealerratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Netwire family

    netwire

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2