Extracted

• • Target

    PP-200446-FDA.exe

  • Size

    839KB

  • MD5

    59fbab4581eaeba4bf0463a1e10fd04d

  • SHA1

    2c8752a3eff0c8baf7f73d3a31c473fc3d9b0647

  • SHA256

    25c728d3e263928d1893e3b3979307f9959f4f1bcd2907a9e820649105e91cbb

  • SHA512

    e6f3cf77c4b38ba2ce245fd6b3a4eda354ef6716a5424e425df22af60593f5d1a7834ace0412072cb3aac834c1341f9e7d9218af60b9f7d403a6e21a8d8a009a

  • SSDEEP

    24576:UjlIhSPd+prp+l55U7J65FVACiJ6EXEr8:Ujl+SPspm6A58mI

  Score

  10^/10

  warzoneratcollectiondiscoveryexecutioninfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2