Extracted

• • Target

    2024-08-13_3912075c2bbaf4bdfafd60bc64b81cda_avoslocker_hijackloader

  • Size

    5.2MB

  • MD5

    3912075c2bbaf4bdfafd60bc64b81cda

  • SHA1

    91c9fa5d7401ad2e9dc8c91fe9534d421311af51

  • SHA256

    318fdeed253a880cb709ff8271eef56322e07745cc8266a8395868d8e5abd400

  • SHA512

    c9b938de71361ccef0d0d66c4f4ba5e44f7b0cc04d8d63d938d817f765b98b741c7af3105279a5ad4850a8fe69c2eeebc078a70abc6c52cf421cf152b9f1bbcb

  • SSDEEP

    98304:HYBKqmTVA7id7RyFZ+bhz4NjufxOU/jIEeQfoR/IuOFVjUu5:wiTyybOSxFIF0wu

  Score

  10^/10

  warzoneratcollectioncredential_accessdiscoveryinfostealermacropersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Warzone RAT payload

    rat

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2