Extracted

• • Target

    b24cc506fb4cef38b05dabfac2e15ef98e8e0d55fccc421b8755230937961d1c

  • Size

    1.1MB

  • MD5

    98b9ee58f23e50a27cc8fd93de2ef08a

  • SHA1

    92da139ae7a2ca9e13edb70f614e6b6a84143b08

  • SHA256

    b24cc506fb4cef38b05dabfac2e15ef98e8e0d55fccc421b8755230937961d1c

  • SHA512

    5648121102a02a8344abb9b68c7106905abcd43085d73607b5b5d8b852418c602588f374a07c9e2f7b68f367868f099929b8025c20136067bc81c09fb9ba0d38

  • SSDEEP

    24576:g0BG9gGUvH+uStz+Xdzu6ENDrhh1bx7n2H:g0PGAeF+Nurlrxbx7G

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2