Extracted

• • Target

    Receipt Order No. 20803415.pif.exe

  • Size

    690KB

  • MD5

    eaa51d8b99a1aa9d11ec05876ea2201f

  • SHA1

    f6d1ad0d23ea2a27181c7ad4f71a6155592ecd79

  • SHA256

    167d71a6a442391712d666ed3b072bf45e6208333d460c0a34d059321d06ef9f

  • SHA512

    ffb2f67d2f3bc922663bc65cbe83d59d428c0c328cb5313d53fb8edbd6f3f33c7b59b4808b80d61facde79ab5bf1c1343c0805bb1f8563797f66cf82c232aa3a

  • SSDEEP

    12288:xGmMZUFunCTZlpRvhKHf2mDoH63Av0ot4QUN24OG5:byU7fpOHn3Ak/g4O

  Score

  10^/10

  warzoneratcollectionevasioninfostealerpersistenceratspywarestealerupx

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets DLL path for service in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2