Extracted

• • Target

    80c700fdbbd9ef5c814248f7c2518a6969eb9c3631823523646666d2b194ddb7

  • Size

    781KB

  • MD5

    ad3eeee344dc635cf361e473b6bed785

  • SHA1

    512ffc124dbc4b67ece76ab0775690a2487fd530

  • SHA256

    80c700fdbbd9ef5c814248f7c2518a6969eb9c3631823523646666d2b194ddb7

  • SHA512

    c0dc95ed59408386f2e23018213c7fbe9ab341693d42a88d06ef7446cf9ec06f40392e40097a2a0958cd06866e6dae6820771bc44831a879b8ee682048e60b16

  • SSDEEP

    12288:ECQjgAtAHM+vetZxF5EWry8AJGy0ATEAmDF4IRZkB8OJuJeCEKZmny9eiBbpSZ5F:E5ZWs+OZVEWry8AFLTE4w5Je2Zmy9pbK

  Score

  10^/10

  warzoneratdiscoveryinfostealerlinkpdfrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2