Extracted

• • Target
    SecuriteInfo.com.W32.AIDetectNet.01.1480.15018
  • Size 860KB
  • SHA256 49d62dd6da73771894fbb042c49c3f487f0f8388aab64db42c8ab132df10c234
  • MD5 169c1e0aa9f7ad60c9a5f54528213843
  • SHA1 c772de39a304c4e4e6ec111a12cf0c0761ffe337
  • SHA512 4841e78a6ba75be80e92d6da19ff9ce7345164b52ea90792647a9d8242aed0d8abf5133deb9055b547d053aec277c9e6ccc47a70f758fcb30c852a9b12f144ed
  • SSDEEP 12288:dfEWcBev3VDN1zOMKmJ34+ZEWenD7Myq95Erxvpr/v7e7UQ9DLo+2oS:xEvBm3lNXKmtFOlnv2Sd/vWDLo+2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2