Extracted

• • Target

    9b245deb2687e8eb0a0b688c3c2111c0N.exe

  • Size

    3.9MB

  • MD5

    9b245deb2687e8eb0a0b688c3c2111c0

  • SHA1

    d52b5b6ce38165926c93fe00fc919f9d03d4a2d2

  • SHA256

    e1f4da5c15bd74cdba49f2f5fd8e048d71dcaefcb578afd71c40a6ebc92e1940

  • SHA512

    c925efddb9d95930172e43ae1fe415adb1f0aeafa2aec9cf1d20e0e82fbd8cdaf28187473d4e3581eea88baa29b87f37303290d793641d32ed20fe67c4a39444

  • SSDEEP

    98304:WsxoMikOEyJMoKigwvaoVsxoMikOEyJMoKigwvao3sxoMikOEyJMoKigwvaot:WsXRIMri/vpsXRIMri/vjsXRIMri/v

  Score

  10^/10

  warzoneratdiscoveryinfostealermacropersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2