Extracted

• • Target

    066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40.exe

  • Size

    718KB

  • MD5

    32bbe58d2336cd18c22d221a3836bd50

  • SHA1

    7b559b7160fa1f0de211afd3dcb81a41a2a7fd89

  • SHA256

    066e985867d56271776ab61510202ffdd1bec246fc15dd38dd17a38223d50d40

  • SHA512

    66e3dd18d4beaffd40845f5b255b8c95c02bc1d72ec4a0fb831f1b6f48067599e89f8e9abdfa8579e443f6960e8e90225c22ba0995a17c56c8282204f47017a4

  • SSDEEP

    12288:9qbjoMfzukYwBZ+DPWeGHutARp7ubVoSYOKe5KkohFISCX/B:sos2+HutANuprIiroJCP

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2