Extracted

Extracted

• • Target

    a2392a5423e76cc1046e4d25f6a62771.exe

  • Size

    3.6MB

  • MD5

    a2392a5423e76cc1046e4d25f6a62771

  • SHA1

    08c6d2bd8777037aa0e77b8937e285002d3a4f23

  • SHA256

    bdeab97a1a23c98b3a53d4c7d6c60276597ca67bd80f5d622ccc20b3d703f756

  • SHA512

    b778fb1419ad63527b5d504145fcec193d994646d20fd3a96f7bd0c55f26e5882abab69e4b99bf5116b16a6e9746226f5bc69113fc43ca856773a867ddaa3ed1

  • SSDEEP

    98304:IE7qm9FINlmzCTadUwYCQs+J7zU0RYvUc:IfJ+CSUw/p+hRYvUc

  Score

  10^/10

  bitratwarzoneratinfostealerpersistencerattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2