Extracted

• • Target

    Nordsee 3 Offshore Energy Project _Firm RFQ_KE-24826.scr

  • Size

    574KB

  • MD5

    a89c88d7302e701a317b026d019913c5

  • SHA1

    557ee76c8bd1b081047de189853699c904bfc0a8

  • SHA256

    ea48def5335b8e664304ae54ff020858a1cb8a804d21f1c474c21e4ef2213073

  • SHA512

    e9673ee11f43f69d65c3faa531a7b0d4ebd7a29b21bf224b78e7bcbc1bf96a124e568e43f218063c1d047fba1190eb89282e607be2c114a8f0f724d525f918f8

  • SSDEEP

    12288:GT7kvDoQpLjKrXq4/ObtRmJE+/oqFxC4JV9ttnJBcDv3uy227akR:GTol2rXqRb/+Aq7C27fGb20

  Score

  10^/10

  warzoneratcollectioncredential_accessdiscoveryexecutioninfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2