Extracted

• • Target

    960be0ebe6eaf853788be74c4256a05e.exe

  • Size

    185KB

  • MD5

    960be0ebe6eaf853788be74c4256a05e

  • SHA1

    706c002edcf16ab77d0fddb87da85dd897555c65

  • SHA256

    44914f8910e1d09003df5fa5ab1545e47ea331aa45d5a3d4ce627907eaa28fbf

  • SHA512

    12037b50bdeef37596a04b6026629164d52586808b1cf4e3a74465cb7dc00c8b850e4290a2978052a06be07d42f900ac9ddefb738dc9cddd87d7c2e9a9857212

  Score

  10^/10

  warzoneratcollectioninfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2