Extracted

• • Target

    Payment slip.exe

  • Size

    4.3MB

  • MD5

    80ecd0b6e261e2e72110d34ccd296106

  • SHA1

    17b4719a0068340ddfac521c9a413386a94c0dc1

  • SHA256

    111bed7d916dd97f632da64fb1c99beb86ab4a2dc13c0b066a8e2ecf8cb2158e

  • SHA512

    dae000acd0dbd514c2182dff2b3641834af29b2168a0a11a001afa7278106acd79770f1fc80513462c52d8dd5a871b52dd8b3ed9052aaca4b94f2b10d181a6ef

  • SSDEEP

    24576:hvaxvPJCJdkd0H2ma1rNFqOsx+7C9hvP9T8nrcXC7VNlwH4mQf+asgAWN5r4mN8+:

  Score

  10^/10

  persistencewarzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2