Extracted

• • Target
    SecuriteInfo.com.Trojan.DownLoaderNET.495.2219.22258.exe
  • Size 487KB
  • SHA256 167a81b7f1166fb131edc2bc558cd91b8f2b196ac204d7a339151a87d787788c
  • MD5 aa9f982855e6b4ab2dc228f469f95e10
  • SHA1 12161af3c79a3ce76ac2240ac623929277137055
  • SHA512 b3525ce790db01a1e799be2bfe147f42b556fc4914958af84c11d8f9c9cb3ec3e874fef9a235756bdbb523dfb2467efc4f2bb94d036215d90da68dcdf1bb25c5
  • SSDEEP 1536:2mu5z9wg9vKv9Q5/y7iRIeDl4+KhAMbOlpl6yfCWwAUubk3n3mVcl:2f5z9wm5y704+SAneX38Y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  warzoneratcollectioninfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2