Extracted

• • Target
    RTM0074163 doc.com.exe
  • Size 869KB
  • SHA256 d0ea29feebc8734fd4c8d700956908b64546161298bce475099cb4d2b6d76877
  • MD5 0012951e81cb2957fd658ce7580d3203
  • SHA1 43f7be229d08ce2681673154395a85d45386f67a
  • SHA512 623bc843d9e296a11b680dd28121996234c9490ca88c5ae25a5da39dbcdbc25307463cc1c23e2da2ba8a443c079089cfdbdde6f75458e7b536bd2223096b70ed
  • SSDEEP 12288:fNc++q2iNbAmDsuxgb/ZCBCdkcERLQ2iu5QkWIAOBK2qjJ5nnlKwHJADgD5MZS+H:fNc+P1RDugNxRTNKBjrl8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  warzoneratevasioninfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Warzone RAT payload

    rat

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2