Extracted

• • Target

    Order_ APRL 310377FIBA00541·PDF.scr.exe

  • Size

    1.6MB

  • MD5

    fdaf9f0b8f08dd76f9093aebe4f605cb

  • SHA1

    fee0b5bed3425667da20dbca9ff7b8a7a9f15a4c

  • SHA256

    c7ab9ad2713d8592d9a8a376632e1aea58652a6dac48cbbcc9003d6a73952a3b

  • SHA512

    684fdbf3ff821985382d9bebcec1e6b194f39fbdcedde0dcabfe3ec09629f7fd617155d0379c9a46c3eb6952436ad41aec30ab862acab1bae1d75900a6e301b0

  • SSDEEP

    24576:KsKdMcaIsLAsHJiV7AEX3aymxcD4qVrcBZLeLdncofSYVTI/DN:KwcmEH9D28Bc1fN

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2