Extracted

Extracted

• • Target
    Untitled.png
  • Size 50KB
  • SHA256 e802fd8a9566b25ff2063176d894efe655e47cb1c746417691083ba3d6e7d8ec
  • MD5 8e9c71ce941f1912f41cfaede1db1e24
  • SHA1 db19ac45731476b950be59a11987a213b768ba50
  • SHA512 07e558d3718ec969ed06ecd499f6ee70871493d5d747b7762c7ef9302ca5faea0bcf89c465b37da88b569369600c918c1ccc4984a82f2b178bbd8b7d88cb09c6
  • SSDEEP 1536:fTub1Va7luiGYNZ+Q3zTXMscxEI9StVzyZLRT6:r8LaJj2gzL7IMEY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  revengeratwarzoneratguestdiscoveryinfostealerpersistenceratrezer0stealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • RevengeRat Executable

    stealer

  • Warzone RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1