Extracted

• • Target

    9c88e3f3ded8c11a4087ba940868b310936d7b763885b4f50b9fe7a8701f722f

  • Size

    10.6MB

  • MD5

    584885e79b756d67adcacf22b63aa45f

  • SHA1

    f82a8ccdd9c3249978b96bf97d246d093c0cdef7

  • SHA256

    9c88e3f3ded8c11a4087ba940868b310936d7b763885b4f50b9fe7a8701f722f

  • SHA512

    11e8feaf2a5ec92b5270ed339a94cbd0d2911d4f3e68cf734bd55a9a3cb1135a51c543cfa08087438ab9f0b546bcdc5a2b5e127fe3c16b1463fec8834a42f794

  • SSDEEP

    196608:PG9aKsMJK6aaZy/h2x4CI9Goz6VABDSrraGelaOV1HnkQpBtj8IxXDqQ7poZ:PnKsMJK65Y/h2x5Xoz6OBDgE5V1HkKto

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2