Extracted

• • Target

    bc69d6c07543f95f5ab4547158c659e599e726f9698a31a102f714eaa3db2b05.exe

  • Size

    544KB

  • MD5

    80d5387bb91e60701a62ba63ec2cd9fa

  • SHA1

    cc30fa5ab70c9c626cbba3d0603b243b00fca86b

  • SHA256

    bc69d6c07543f95f5ab4547158c659e599e726f9698a31a102f714eaa3db2b05

  • SHA512

    038275147bd11a6775e7d85887b230165c6cfc3eeffd934f9540a6a1740046e13b6e24144514489e680460b8ff9517f310c46b3f1246319122f7d051f0d3b2e2

  • SSDEEP

    6144:F6Uqd2GhNHAQHXcqUSheJ3xWEAnISvWM+/VxjnXGIbfE4hxqTnsZvK:8Ui2iNgUXcdSAFAjvWHGIrZpZvK

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2