Extracted

Extracted

Extracted

• • Target

    PolarBoot.exe

  • Size

    1KB

  • MD5

    23eb8f9e7d4b2191a925c0acec78d846

  • SHA1

    023ea9d53ad1d26695c7f9b9f655a8b6bf627eb4

  • SHA256

    1d2c73bff499484b33b1457320ff967d48469a96ff41874075bd4e48b6f72906

  • SHA512

    c638e22185d10767e6025d444f912be71292c022e8f483efadab31adc6f1a8210922527d2adbc880b99e27941b1eece8960253f28d50a771df8c079e160a23d8

  Score

  10^/10

  metasploitremcoswarzonerathostagilenetbackdoordefense_evasiondiscoveryevasionexecutioninfostealerpersistencephishingratrezer0trojanupx

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit

  • Metasploit family

    metasploit

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Remcos family

    remcos

  • UAC bypass

    evasiontrojan

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Warzone RAT payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1