Extracted

• • Target
    9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
  • Size 39KB
  • SHA256 9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6
  • MD5 3a3752bfa76ae16628e03d4a00b3e1c9
  • SHA1 d5194572e7781aa893f84e59046bcc286d76ee62
  • SHA512 0871580c12e9d941a152c9ec0124aae2a3f072484baf050d85a49bfd1147d8c151965c3f9779be6182fae218b0e1786b8c82cb90b29e5c88014ca8a9bcd01018
  • SSDEEP 768:Qnbsx4iDVJLU0DA6Xlnw0ei1s8jdj6yV5SNUI:sbsx4oVjXC0ei1s8j6yaNJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Contacts a large (4661) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables embedding command execution via IExecuteCommand COM object

  • Detects executables packed with or use KoiVM

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2