Extracted

• • Target

    20208135867900890.pdf.exe

  • Size

    957KB

  • MD5

    f0aa6633598cfec9d19184310999608e

  • SHA1

    382494e8a175068c03298ca91a723f328c01a5b1

  • SHA256

    223bc31b60a1b00173b137578898902d809838d04c91562aaf7cf46881cc5ab5

  • SHA512

    8587b44d76ee9bd2f8a3f22cd76e841ef9f84e7788fc4bd084ee52824776b1835352ef6f0c2e761c57b7212d4639c8b842566a9b889fb739b98bc8c8b25af1f4

  • SSDEEP

    24576:HyFtd5Y0/7/RPu2JC9vKDpzouHNtHITPn:SFtd5Y0/7/B5JFVz1HXITPn

  Score

  10^/10

  warzoneratcollectioninfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2