Extracted

• • Target

    f5e1b30ec44e8c2a6e6a3c67bf7a5ecd7474c978668724eb49141608a3a60add.exe

  • Size

    784KB

  • MD5

    4b541ff698f1b6cb633140e65dcb6f5f

  • SHA1

    78a89671c275e0498f66393d2bf0c0d9ca84569e

  • SHA256

    f5e1b30ec44e8c2a6e6a3c67bf7a5ecd7474c978668724eb49141608a3a60add

  • SHA512

    3f12c2b92a990df809e689607fce5e9d3135fe467759bfa4ed1dccc0fb98df71cfca85db904fc185c17b697a2540b44bc55ad26214a662f5ae11b25ae0b70639

  • SSDEEP

    12288:Iwh6wEx2iNNFR9YJcR8bNvX+nXq2ow+Ubm1Dt4:Kwk1fFLakaNvX+swK

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2