Extracted

• • Target

    SecuriteInfo.com.Win32.TrojanX-gen.28372

  • Size

    2.4MB

  • MD5

    d7fd8fe20f654e456b8594c8efa65e6b

  • SHA1

    8f2eb3bfa743a94af8f0384f904d7f8bb26157d5

  • SHA256

    71e49f01b408e4d69fc71d916e25c88ca323acd26f37a444b5c1d496d8af7790

  • SHA512

    7e83575a5b5b09af12ef3e94d7024426a4963e88caf8427065ba83023299a3952090de98a8384f5ec1e9730ba3ab5bfaf63ba2ba302bed1d12850f5831214fbc

  • SSDEEP

    49152:UznLldaXlocU7/TovuWEW6v6gtZnQ6ujmeutgJFDmHjGRmlVp60ZV:UzLjaXlucWywtKaeu8KHjZVE0X

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2