Extracted

• • Target

    ac18d9da9135fd1ae1dd701a76f33c25

  • Size

    507KB

  • MD5

    ac18d9da9135fd1ae1dd701a76f33c25

  • SHA1

    d4f4e58e4f85fbdfa68fa11e8c4766844c96f63c

  • SHA256

    d8e6ae61fefe2f312f15fddf23fcdcba6ea02bc3cc1a1b4566e03130512c9882

  • SHA512

    eaab4f765994471cbb0fcb10bee6c5b2306d26d23d27b4f6b1bbb2d711b0ca07218e0b617341466bbe9a0a1143c16fa5009bc4bcc6d23a8142e8441b30e5f98c

  • SSDEEP

    12288:0IPHb0IoX/9fSp3TRCQeQEkNWkXgQSEwBV:0W0IovUDQ9QEkN1XgPEwBV

  Score

  10^/10

  warzoneratevasioninfostealerrattrojan

  • UAC bypass

    evasiontrojan

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Windows security bypass

    evasiontrojan

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2