Extracted

• • Target

    4f52022aa6286c18573e79cb079d5c9a01382bf1b4685a5a0dcc72cd6307b277.exe

  • Size

    703KB

  • MD5

    5d5439b5ce694c7329f002033dc479b5

  • SHA1

    fa00d36077c1a8442c5f44cbdf7545a041e85ed3

  • SHA256

    4f52022aa6286c18573e79cb079d5c9a01382bf1b4685a5a0dcc72cd6307b277

  • SHA512

    f66685591e4504f802f4895bbfbeee8a524a78a09d7813e4e9d5e34cddaa2ea49635db1c09f658f5279e7999fe7a59db4514187e2f33f4f3d5c02f9cf6b8fb0e

  • SSDEEP

    12288:4Io7W7X/WI7oDLmMjWQumYISeIQAAApLlX2/MT77oyhDdsCGW:foSbWqqmFQumNLInpSAhDd

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2