Extracted

• • Target

    1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361

  • Size

    1.4MB

  • MD5

    c5cb27cb09bdc222aeffaf0cccb96bad

  • SHA1

    d3d9681b8ee4730dca84d8cde608f12348bfe8e8

  • SHA256

    1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361

  • SHA512

    a05bc118eff3c215debbd9909dd3d34cb3d0f2adcb47ea29e626416275e7793096d6e8ba8448ebfff4fff93cb6b142d2fcae414a403de57ddce9029b019d6f8a

  Score

  10^/10

  purecrypterwarzoneratinfostealerloaderpersistencerattrojan

  • Detect PureCrypter loader

    loader

  • PureCrypter

    PureCrypter is a loader which is intended for downloading and executing additional payloads.

    trojanloaderpurecrypter

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2