Extracted

Extracted

• • Target

    7848a7141ed6c9d46d796a4e6d215a41f7ef46d19a97c89431773292f4eb519c.exe

  • Size

    1.4MB

  • MD5

    95e5738e169f05136d6c4e9c4f1b9729

  • SHA1

    c6188d7277f43d23531a5fb7ceeeb52059832441

  • SHA256

    7848a7141ed6c9d46d796a4e6d215a41f7ef46d19a97c89431773292f4eb519c

  • SHA512

    14e583dce536ba93f804d9741a3014ead1d992f9758b7d56048ac264cb0133d5030b26f778980e137030c6e92c9f563eb82f933ecfb7d0517b96a50282bf201a

  • SSDEEP

    24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYr:Fo0c++OCokGs9Fa+rd1f26RNYr

  Score

  10^/10

  netwirewarzoneratbotnetdiscoveryinfostealerratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Netwire family

    netwire

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral10behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9