Extracted

• • Target

    undercover.exe

  • Size

    642KB

  • MD5

    c7dde9741228fbc2c317bae1ef4c8231

  • SHA1

    26deeac180d6bf406bd004a718cbc86b1586c494

  • SHA256

    d1d0a4c2a7489201006748a364e5cc6dca7b0721dbce83c54566c555bc56ca68

  • SHA512

    05508db7f290282c91d461b7284c1856ee9ad2e042dc57f9203f79374492ba69c457985177d9e11195758680b6c211261fa7df2662c380edb1bb0b3678e1139e

  • SSDEEP

    12288:y0WWObW5cBj7O56jp7t8c6B5wAmjPDynKr7fP7E3caoAqI+lRW:l4JugjEc6B5wT6KrL7E3hVElR

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2