Extracted

Extracted

• • Target

    Request for Order Confirmation.js

  • Size

    132KB

  • MD5

    cf48d5899c9295bffe75ae7a996827cb

  • SHA1

    d11b50ea9e628393bc2ae2de9b92251c555bfaa3

  • SHA256

    be6d11434ecb91728a1a8a19501378e1202f18f927430aa8f4ba4b4ea16dc04d

  • SHA512

    02127309eaccaea558914137c1fd8cc7f57febc756b20f0164ae30659c10df5065760f05ffd19e1512427d716d2d9e122cdcf64524d35b8501257e0a636f59c2

  • SSDEEP

    3072:lN0l/ZP90LxFAsyYgQ/yNvyrr5Ae0FNoQVN0l/ZP90LxFAsyYgh:kZClF+1QW21zKF0ZClF+1h

  Score

  10^/10

  executionwarzoneratcollectiondiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2