Extracted

• • Target

    2024-09-08_922e0ce72b23593266b0486c19a6f6f0_magniber

  • Size

    10.6MB

  • MD5

    922e0ce72b23593266b0486c19a6f6f0

  • SHA1

    f0cb61f5fdc2c2d32f9d6155809ef2bcd629c154

  • SHA256

    6af7f530b868da31e2c20ab699720cc32e307bb21df009209bfd17499986edee

  • SHA512

    86a364059f8b8822577c46b5b884e465a57c210549e4ddab5fa3a105f5152f7ec687cb62f04f5a5ea4e014a3e036016498581d2a99c88e16961093b2df835c14

  • SSDEEP

    98304:+YBKqmTVA7id7RyFZ+bhz4NjufFYBKqmTVA7id7RyFZ+bhz4NjufGpFK0U8AmJNl:5iTyybOSSiTyybOSMFKzYN

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistenceratmacro

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2