Extracted

• • Target

    TBIG.exe

  • Size

    13.9MB

  • MD5

    c6223c55914673031d7f7bbc5e7f081f

  • SHA1

    53c469573725b764dfe5e262b9a0d67419a4df4c

  • SHA256

    4813a5905b2003965fe10155c8daf3cdbb57017af02483a53a2d5ca11a9270f7

  • SHA512

    dcb587278f9120c19834ba7e249b4df8abb035e86847de3400d7d649ac25c2fb49621cd129d3f55b06866f425820a8fac7b293e3a526db10663ce01ee07c6684

  • SSDEEP

    393216:LxhzkMxhzkaxhzk4xhzkuxhzkAxhzkOxhzkwxhzkuxhzkExhzk:Lxh1xhfxhhxhzxhhxh7xhJxhDxhtxh

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealermacropersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2