Extracted

• • Target

    2025-04-15_2d0b54fc65ae4985a7b4e5f5185830e6_black-basta_elex_luca-stealer_metamorfo

  • Size

    1021KB

  • MD5

    2d0b54fc65ae4985a7b4e5f5185830e6

  • SHA1

    43c5e002282f26cff3c04c21d7a8aa6543c73793

  • SHA256

    0feeae76bf2e45d48fcdbff5dbe5a4a52f7340d28aecae361f74c5feaaa9c87a

  • SHA512

    d54f2ca34f089ac819643bf1705747aadb822ec8594751936c43fb2114b8d4c281019a3b4fe453f768cb8f4726083560e8479811c1e7374be215ef76a2df4885

  • SSDEEP

    24576:ANA3R5drXj1qHp+dbuoubrF5k8zhX5Sa97WM:55gJWbwbrFjVX5XV

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1