Extracted

• • Target

    39ef3dc09d0e0c34b96b6eb08a371670N.exe

  • Size

    3.6MB

  • MD5

    39ef3dc09d0e0c34b96b6eb08a371670

  • SHA1

    2ca2ec24ae0a083c2b97f2c773dbcd61ef1685c7

  • SHA256

    d13a464ee088c56bd2702cb6e6796d8b2791c713ef85ad2e425997e4be88d4a9

  • SHA512

    a49c1ab76ab4418ab2dd57af20d3e3f9eaafc368b5408c11d5b64f9d237c38be1019253a2fa84b5d9587858773ccae8c62e54fff6a80c820cc63dbcb09ac3f94

  • SSDEEP

    98304:FhDooAIfNwY9d32aOU/jIEeQfoR/IuOFVjUu5:FhDooAIfNJTTFIF0wu

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2