Extracted

• • Target

    1ec4d511593d7bcebcf3a1b0d462d6f344321c3a06821e35910160ef9c438258

  • Size

    2.6MB

  • MD5

    7ee61aa04ea2aab3b2277acb03dee13d

  • SHA1

    69114debb34e2af3568c8252c6cc0e8c94bdbc64

  • SHA256

    1ec4d511593d7bcebcf3a1b0d462d6f344321c3a06821e35910160ef9c438258

  • SHA512

    cd16ec792092fe18d0111b67d49435b6f42d45da704470fe5e27f9f71577e7b1a33f0d012ec90d533d5a28669afc559eb17a0a66c589fcf485be0eafc02796bd

  • SSDEEP

    49152:QcyMVrv/5Dvb3DLhMVRRL14mzZkHiK6JZAW2ROQcverO04T:Q0lb3fhMVeH6o4T

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2