Extracted

• • Target

    Obavestenje o prilivu za 16000501003826304627.xls

  • Size

    128KB

  • MD5

    cadc7a1ce95a518b28bc427259034546

  • SHA1

    5f362f13ceb06e1b8e088bbaa5fba367a6bff837

  • SHA256

    51d7e9d83ee47fde362716e9c50252dff4ea3891a2cf89e4be84d1551d104688

  • SHA512

    16db805befc401a2aa5883aedfff24d9785c9df31f535221779a5d6090a22ada96025739c42ccb6ed0208b8c43015db6996dba688d95fc8b461988b2c92a6e3e

  • SSDEEP

    3072:msk3hbdlylKsgqopeJBWhZFGkE+cL2NdAnROAPDU0wERoB1HBCzEY/G0aDYKtOKW:zk3hbdlylKsgqopeJBWhZFVE+W2NdARX

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2