Extracted

• • Target

    TNT Original Invoice.exe

  • Size

    599KB

  • MD5

    46321b1bc573a076cf8ea7cb465265c9

  • SHA1

    0f63beac6211f02def56730e3c92e66577abce93

  • SHA256

    86daf1fa99266c6c93338a27544826818d36f983547fb54b5b0c18a95a3671b7

  • SHA512

    76e563ac759ff6677dddffd4a5e2a74a56694086c71526a407ff537b3cbd5ca6c2d0ee9cadc272e1ae7bea3a615faff43d7881600b1f18b728a14c9ad84a36c7

  • SSDEEP

    12288:44xxyhCTPS9TRZBdqxuR6mCJhdNWM6owSaBiUrIlZIBl98bddZBnaD5jWcy:Lz8TLBdLRsjX6owS9IlibNBnaVK

  Score

  10^/10

  warzoneratcollectioninfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Modifies WinLogon

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2