Extracted

Extracted

• • Target

    b7247bf3220284da06e6bc790db88117a4549952b8df54b60a7a2a4a1070802aN.exe

  • Size

    1.4MB

  • MD5

    8d17ca8014df6edbfb5ebca0c318b470

  • SHA1

    0c041b371c0e09ee1b336fb1ac8149e9a31c0068

  • SHA256

    b7247bf3220284da06e6bc790db88117a4549952b8df54b60a7a2a4a1070802a

  • SHA512

    e10216a6a6486ff5f85da8d598f0cd745da34f5af597f67636c6e7052fc8e9cd3337463f7b9dfd4db28c5172c0af8515b8a665c4b60089eadc7da0c3c0f1056f

  • SSDEEP

    24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYr:Fo0c++OCokGs9Fa+rd1f26RNYr

  Score

  10^/10

  netwirewarzoneratbotnetdiscoveryinfostealerratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Netwire family

    netwire

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral10behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9