Extracted

• • Target

    SecuriteInfo.com.Win32.PWSX-gen.28365.916.exe

  • Size

    718KB

  • MD5

    32bbe58d2336cd18c22d221a3836bd50

  • SHA1

    7b559b7160fa1f0de211afd3dcb81a41a2a7fd89

  • SHA256

    066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40

  • SHA512

    66e3dd18d4beaffd40845f5b255b8c95c02bc1d72ec4a0fb831f1b6f48067599e89f8e9abdfa8579e443f6960e8e90225c22ba0995a17c56c8282204f47017a4

  • SSDEEP

    12288:9qbjoMfzukYwBZ+DPWeGHutARp7ubVoSYOKe5KkohFISCX/B:sos2+HutANuprIiroJCP

  Score

  10^/10

  warzoneratdefense_evasiondiscoveryevasionexecutioninfostealerpersistenceprivilege_escalationratupxcollection

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Modifies Windows Firewall

    evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Users

    defense_evasion

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2