Extracted

Extracted

• • Target

    ff64fcc6ccbb482ca0bdf539c492555de86bf3666a8f7979c9d052225be0589c

  • Size

    8.8MB

  • MD5

    bd40cd2f9b60a3b24f9a59d39d234374

  • SHA1

    28888c62f7a8a3b7a8fe6213b9fb2a9883c9b1cb

  • SHA256

    ff64fcc6ccbb482ca0bdf539c492555de86bf3666a8f7979c9d052225be0589c

  • SHA512

    c6272bf8ab06fbd0d2e5f7e8488c0c1f686f6bf5ad255762d61f7121bd7148816174366a521a6cbd9be4df1b2d22e6fbea5cbad20bac8ffe9d8445847dbb636b

  • SSDEEP

    196608:LiDSsREt5lLjiCIJMrsSO6YNoxzVwdFnRZmpL2FxrQtyBP:0SsKtfLjjHBB4SpL0rQ

  Score

  10^/10

  bitratwarzoneratinfostealerpersistencerattrojan

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2