Extracted

• • Target

    RFQ 675766567456534534534534535434534564456453.scr

  • Size

    580KB

  • MD5

    6772fb0a8d636027e91b8fa238c4ab3c

  • SHA1

    1c1a0b57de7fa94ffadaaf91f846f5a8bea8f019

  • SHA256

    247bc285f9b882ff9318ecc7049c4209d43187c0657988dcce7fe5f0a6067be7

  • SHA512

    1ae632ec6c00852d2e9ee6953cc15905fab3599eff4340ac0902d99aa5fc0aeb7f21d1a8dc0ced672ee323e54dae374216f19d1f7475d857df04c2fdf94d319f

  • SSDEEP

    12288:ShjS4JRwD94pRZASB9+VUEJxcWEak/+s6uQxNlJcbq:StSqR2ipRZDgeEJxP3hb

  Score

  10^/10

  warzoneratdefense_evasiondiscoveryexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Modifies WinLogon

    persistence

  • Hide Artifacts: Hidden Users

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2