Extracted

• • Target

    BindedUDPexe.exe

  • Size

    556KB

  • MD5

    0a6713d8ea9057044e96f2f4b8cec7c1

  • SHA1

    1ab168cf053ce524a3b518303b2b5b995e886da2

  • SHA256

    2b452fa6e3b61b098529506ec1696a738d55b08886d56ce6a1a6df4492f53a84

  • SHA512

    88cd0be9173debb427068be40560360b8ef8889aa28401878ff297f17019842b4a1576c85baac3f4ccd58bf003810c8ca3f8bff508866907e0573be316bcee21

  • SSDEEP

    12288:8wqYSESaejYX4ned15Ccn1IoufyEux9tPcOwyxZm68rjC6b/1MSPo1CCQKtv3C5j:8wRSESaejYX4ned15Ccn1IoufyEux9ti

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2