Extracted

• • Target

    Purchase Request LIST_T7FIBA00541·PDF.scr

  • Size

    355KB

  • MD5

    1fee9199dbf1e92b8cae1d7e9afacd1a

  • SHA1

    13164ae4027514d2b172f6069c59d2b54938380b

  • SHA256

    d99d15e65b3dc0001e359d4375be1a28141aef7141dbc85d8f57180c36d63b61

  • SHA512

    07b8e5a3113b40d5bc992c42c2feb157b54118a0096e97797279f9f251749cbc57df2d79fbf2d9b9c69f28c0f1f828aa745ac038780a41e144ba9ba2d4ada5ce

  • SSDEEP

    6144:ILLolfJ3lRCufFLn0qZUNsJIjwrwWIK+krlMtqfKopwZncuc47:Ifef5lHtAqKN0Ijw8EOtqfKumPc4

  Score

  10^/10

  warzoneratcollectioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2