Extracted

• • Target

    41d59949e5dbd3c68880f3932c4d0d45dd89a39bd5daae3dd60a7644cab265ff

  • Size

    930KB

  • MD5

    1c30283efd4e34d6990987ff969efab5

  • SHA1

    c5a1d5fa1a29d8c8bd2e6f82bfc1294c35200fa3

  • SHA256

    41d59949e5dbd3c68880f3932c4d0d45dd89a39bd5daae3dd60a7644cab265ff

  • SHA512

    b022726e97bd74c0d2183344d2ca676aea310481557c6adee252a3fafd4fbce7ec284ce9f30512e1b1f20f5bf3e6d3ee97351f8a039477568af3f44db251906f

  • SSDEEP

    24576:UQc1P7RkRyAhXyvNpEKajYZ5BP2AGiZYpBY3S:ULq/FyvNpEbI59fd13S

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2