Extracted

• • Target

    PO-2019-0206DR.exe

  • Size

    684KB

  • MD5

    26b437c0fac1ab41712f80cbacc028bb

  • SHA1

    7af2f6e902aa95f030453618875b5f6665b9d1b8

  • SHA256

    00d8516cf44beee7b16042dc82dca4a1353e0f1a06210f8f5a576f8451e2c052

  • SHA512

    db626946cae02de525008e04519f4e7bd7523ae78e4a6446b6fb9c3a37312bb3edb7ed766867723e8484856a9b3efdb14965be0dfee2214117d58dbd8ed432ce

  • SSDEEP

    12288:H4QycNStCd0cDF2m/4q+wAfFjy2A0rJvjI/6dJyL/mU7obiS3Ii5W+JoljtH8lFf:YSSoNDF2m/4q+wAfFjy2A0FvjI/6dJyK

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2