Extracted

• • Target
    DHL발송서류- 20180904153201117119330^^PDF.scr
  • Size 1.0MB
  • SHA256 02e038ab4393164f91b8dc9bf2e09ddccde0f4dfef9aac731767b241d4fea47c
  • MD5 b490e1c3a363d84178347203f4a39b20
  • SHA1 0b4aeaf7f83b7fa9d467126397fb864954be0b8e
  • SHA512 0c496d2b54e3867df520f22ada64aa0011b939d71611ac9af2728f0b6a94e7b818048e5a12d86f69e24a466af274aaf726a4881dd4c3d3f999e479d47471d864
  • MD5 SHA1 SHA512

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2