Extracted

• • Target

    warbpoy.exe

  • Size

    573KB

  • MD5

    16b04d579ccf98513ff237efe81ff220

  • SHA1

    a6f44cda5ef698e9adae066a0ec97068663c0ba2

  • SHA256

    10063fc8719c94ac8496b81fd27f3029104d152c42ab415f1613376b13548814

  • SHA512

    873decdc1c62a3a67db86f18a766e649b2a1c76d0406f9a7b28d51a57811513c0df1e27deb3205c29a0f32ef6069fecbc67bd01e739c2629ccff51cc73a1fb45

  • SSDEEP

    12288:k4lUUjeFqvM/rKpO/S8DksPHxe/NWBen9U0:/jeFkM/W/8r5eFL3

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • Modifies WinLogon for persistence

    persistence

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2