Extracted

• • Target

    ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44

  • Size

    708KB

  • MD5

    ecb6e0b8c1c969fb81be1b5d52ea4bab

  • SHA1

    aa7d5a7a84f7a2b24d5177bfc147561964d0a250

  • SHA256

    ce36e5e77d9501f5892c8d825104738ded2f9d7ab2074af51714e86c18894a44

  • SHA512

    4bb4313c268de141113f70a485b4af341ba4130329c4a9d1c734b2a1e0982e4f5da6097765bc7352bd5f7cf34f48b1b68f62d996144c5c7bd3153c0533d45b48

  • SSDEEP

    12288:NGcpdQGrhJFun+3L04NtfzaAixx2L6sqyHdUPsjIPF81DLAIM:ND2Grg+I4Ntfzay3UMiFay

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2