Extracted

• • Target

    4dab803dd6bf78390418adc70ee7af31.exe

  • Size

    609KB

  • MD5

    4dab803dd6bf78390418adc70ee7af31

  • SHA1

    52f81dcf210244d5281d201efbe8167798478ee8

  • SHA256

    dd1fa6cb67aa97468e62afeec6bfa9c1cb52f5acf029ab77a0fdd2e34cd50a21

  • SHA512

    18237f0976d2d11d7e6a5cd7c4091a295b762b1fac89b1c898b56af75e792f90b41ccf18c17a9a95f77032c3a08063d55dfee0a2331848ee22fe3746c85c4889

  • SSDEEP

    12288:qK9K78j8qshDy6MmYL811ekusuEO76lfTDSBXF62Ux69tl0a:qK9K78bshQmYL811nwel3OXF62S0t

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2