Extracted

• • Target

    aac25a5b7929b91cf1b154a60bc5332e.exe

  • Size

    716KB

  • MD5

    aac25a5b7929b91cf1b154a60bc5332e

  • SHA1

    6416746a9b09a475be10d951b063defa90590463

  • SHA256

    0804112ae4b5fac210ce60a05ef372e96cc86db6bc25618db0d33a46388e7c9c

  • SHA512

    a690e25e55d476966c5921f96ce98478e37d1707609f88581d9e6962b8948cb345847af6ae83e9cb5d575b79f5fce5dd9e9837de710600aa3458fffe2cb2e061

  • SSDEEP

    12288:42mn2iNEWJ1W24C7ovYqgPOCd3JUKq2tD+jMbRq970Iy9l:21VJ1W2NqgPOOGt2p+jMbRq6IC

  Score

  10^/10

  warzoneratcollectioninfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2