Extracted

Extracted

• • Target

    Company Profile.vbs

  • Size

    189KB

  • MD5

    ee122a95d229ae3027779aaa863f11be

  • SHA1

    46b92d71b1a3cfb213ea400f5e1e5cda0a7d7ce7

  • SHA256

    9ad5fb5c8f0b886ed22e202f5bcfd8e8c4d0617b270660d0907ca8c87ac2f0b7

  • SHA512

    4c088ea8528b6525fb284e42020e74c979c372f805495c23ee4c36635a2a6199203115ec5dbff523d0a1741a60e4612643aebadd44d81a288acd5a3c506b5cc6

  • SSDEEP

    3072:c4ehYpD1tZytL6pMdHPppygt5ppGwt7iLnst+7PbcqMm+/QcZc51:c1eD1T4ZRWDcqj+/Q551

  Score

  10^/10

  executionwarzoneratcollectiondiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2