Extracted

• • Target

    2024-08-18_3cf6237c80c7e8fed6fbf9dd45ecfc77_magniber

  • Size

    18.0MB

  • MD5

    3cf6237c80c7e8fed6fbf9dd45ecfc77

  • SHA1

    912776f4171f3e8747bdfbca30e98fe18c85dd8a

  • SHA256

    dc3a07c8529cb1a7074a770c29b0e9f7243496aea6539a7d295c8aad9420735a

  • SHA512

    c47f524d4838576a22faadffb17b206a5ab86a3d7eb1f8bff5dc5638dded74409d02c2f6f51e55df951a823836f03fdc3d0d31717f95fca2e3776ce6718c29ff

  • SSDEEP

    393216:Itw4OSUZd8eSbCtw4OSUZd8eSbztw4OSUZd8eSb:It2pr8kt2pr85t2pr8

  Score

  10^/10

  warzoneratdiscoveryinfostealermacropersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2