Extracted

• • Target

    03344799.exe

  • Size

    26KB

  • MD5

    f97dd898670874b524df23d89dc6a12f

  • SHA1

    98b76fd8b13e66e73215fc6f1f3b1d510d0d504d

  • SHA256

    841fc466a01841b07d66a4e99f2695592f9fc02c7bd24e5f3d74259a345d5110

  • SHA512

    0e82501494b30e88b82ee0291e56b132a0615800d4bce3a031f06a34b7b0e9ef9a89c18648e9b4c70be460089f429b6052b5aac306ad979278e276a3c1308515

  • SSDEEP

    384:/T1sZrG2iPQWRErIYib+W42KKxPxh8E9VF0Ny5dF:/BsZa2mf+UYib+WnxPxWEj

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2