Extracted

• • Target

    steamupdater.exe

  • Size

    132KB

  • MD5

    ae272da48f63b0c97b06f92f00f4ff3e

  • SHA1

    a6c26a2de3abaefb120845ae642001948a25b141

  • SHA256

    1a8da2a01c3fdd2d155b6ed685818988bd980f94b7f4eff3011a88bac8baaff7

  • SHA512

    345c2ba95aa64d7dbea7b912ee8005211c4bf259634dca803ccd55b2b2176929e4fc2c2482462c733abbd8c9c9fec2c3ceb8e80559804b49911baca0bcef9032

  • SSDEEP

    3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a

  Score

  10^/10

  warzoneratdefense_evasiondiscoveryevasioninfostealerpersistenceprivilege_escalationratupx

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Modifies Windows Firewall

    evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Users

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1