Extracted

• • Target

    Ajanlatkeres szam221909·10397·pdf.exe

  • Size

    982KB

  • MD5

    0123b43115849331501c21f58cad8763

  • SHA1

    e14553622a714d9e1fe731ef06b083c5654e6d13

  • SHA256

    aeb049faf805c590ca7125f2eae56483200815aa964b7cb9677d4a5d63b1bcd1

  • SHA512

    fd5eeafded2558f93d5a0b2bae53764f851f892063bed6ac5ed96dae08ad9c5d1c75c6846650e0c2d0f9d8e849e1f342b855e07e78136b715cb171fe703ee630

  • SSDEEP

    12288:6dW/busnDZoRtM/sT7PEWjBtPXF2ruey61e03vcz5nf:+WmtysH8WjBtNuvewMh

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2