Extracted

• • Target

    INV-20230822.cmd

  • Size

    4.7MB

  • MD5

    073eda398bb992c245ea72ba948282af

  • SHA1

    60b8af064e8beae96829cc62fad8a0f34e745145

  • SHA256

    c37739fd8d58467e960f81f0f5260b45ec23d4c772d3e3cbb0c3d42089fdf6ee

  • SHA512

    a75001cd01d9a1260bf01d9320df596e490a6fd8ad9ca2921bdb67464422613ca94425dcd1f1db673acf9e471b1a1ed4cb6856acb99dd3fd2383c2c4131c4449

  • SSDEEP

    98304:4v8upB6APFAYS8ILk65Hxp44MVghKrVy+dr5/FtqvG:O8upg+GYCkf4qg4h/FQvG

  Score

  10^/10

  warzoneratdiscoveryinfostealermacropersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2