Extracted

• • Target

    cfbff78272aa6680ec533fc66b4d2f10145c0b9b9a45fcf6f41bf65f54d6191c.exe

  • Size

    453KB

  • MD5

    b4316f8cbe7a62d557b824d377880dff

  • SHA1

    76dd09f92a4a22ab2f53be5ad3f3cb88a62cac1e

  • SHA256

    cfbff78272aa6680ec533fc66b4d2f10145c0b9b9a45fcf6f41bf65f54d6191c

  • SHA512

    bb683485a674a7bbabbb0e64f322f91d7a8f4a495a51f552f6018a8b2e609263353dd5a5c23112b41f2c6a3110481e79f51add9d289958b52d909453198d81f6

  • SSDEEP

    6144:DEkW8RdBHMlU8LFMrrtMuV3VUuj1LNBvyRS3Bfw/LV/FhWSqQnql9Flui/PSpZA:w4t8LFMftxeI9vkSRfeLV/FTqlLiZ

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2