Extracted

• • Target

    bf2897f4d98b84ca.png

  • Size

    1KB

  • MD5

    0226fff44d4c6525b16a81754ae3e38e

  • SHA1

    4978a0c3b095b7543b4c329b545518dccdc6c9df

  • SHA256

    b4f5de44a5baff70cc3554c1963e2126d68b80fe703833b1a84629d1b003670e

  • SHA512

    fa9ef790307999534e22697d9eb81be3dba64f0c5e244e94943b1c8ecd67934c854bac6d7244a9f11dbb269186970e178050f124e150a4b942f3f61c4a036732

  Score

  10^/10

  discoverywarzonerataspackv2executioninfostealerratrezer0

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Warzone RAT payload

    rat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2