Extracted

Extracted

• • Target
    xc6bb808e9efb1fdc3b93f3357bc55fe8ff4d08c9331ca924621da6a31ef5643e.exe
  • Size 1.3MB
  • SHA256 c6bb808e9efb1fdc3b93f3357bc55fe8ff4d08c9331ca924621da6a31ef5643e
  • MD5 1b7587c4b88b29890900f7129a4ae8d0
  • SHA1 c1c2bb3ad87cbe8720d72706e9d7fb6493ffe9b6
  • SHA512 55ecfad247e2de93ae0c68c9454befe9682fc2a197efbc40c7c1f7a0e3f4ba31c13182bc88af7f2e537a82368e9fff53abd4c0a46735ffe09deb674d74a7a3ad
  • SSDEEP 24576:au6J33O0c+JY5UZ+XC0kGsoEAdx20W4njUprvVcC1f2o5RRfgdWY+:su0c++OCvkGs7Adgrd1f26RNY+
  • TLSH
    T16D55BF52F39EC2F0DE175172BA7DF71A2E3B3C254530B956AFC52D3AAD21021112DAA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdiscoveryexecutionnetwirewarzoneratinfostealerpersistenceratstealeradwareransomwarespyware

  • Family: Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Family: WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • NetWire RAT payload

    rat

  • Warzone RAT payload

    rat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2