Extracted

• • Target
    PaymentSlipReveipt.exe
  • Size 308KB
  • SHA256 dbe7fdd2f0e7270387053d2955f549a46a6699b29ece6b3ff20a6bd11c06064b
  • MD5 27c962bc41886b2fae4c822abfc796bc
  • SHA1 e14f67bfe3b1cf5e9197b5e8437b23cdb141e0d9
  • SHA512 145e6946970c9167a14bfb517cea653b7843e89dc5d77723cb3abd51d40af9ccea4a0996a88bea8c2e1aae55811640135d37ebbf83ad458ec7ca5c8b3c35098b
  • SSDEEP 6144:SYa6AvUotjvBsR61qoro5PBcxwN15a4Vr:SYYzjeRAqjcCBr
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  warzoneratevasioninfostealerpersistenceratupxcollectionspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Modifies Windows Firewall

    evasion

  • Sets DLL path for service in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2