Extracted

• • Target

    ce67dd2cbfbc22d1ee45c2429da775036c0894f72021df6ab0eb849e96e29daf

  • Size

    62KB

  • MD5

    fa78ece109e579e23450df0e22125016

  • SHA1

    f8a67ae477d06f287c1186fae9e8c5e51ca2f751

  • SHA256

    ce67dd2cbfbc22d1ee45c2429da775036c0894f72021df6ab0eb849e96e29daf

  • SHA512

    1b20859efaa4eac89b405873fac634839c5b9ade6d2aa53c7b329ae5d1b8b1da9eccc4f1411ccfff82c24347697dc1ea46c24f88a9da2f69c14b90bab5882522

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1