Extracted

• • Target

    2025-04-15_9759affa4a1a347b190a16750e35a89b_black-basta_elex_luca-stealer_metamorfo

  • Size

    1017KB

  • MD5

    9759affa4a1a347b190a16750e35a89b

  • SHA1

    01f22bd70b58a4e0e7689608e3b91e3af4e9d689

  • SHA256

    479e885030fd31f559f3293f9d4d73df551e9248db02766bb82211b0d7a09f40

  • SHA512

    a72666f5c015676066fe01dbe42b76bb8ee2e2c591c8af9b8bd4ef7428541a184360c2ed31b8140e83f5abd61e8fdee3aa3e8e37110aa1094a93ab598b72453a

  • SSDEEP

    12288:9crNS33L10QdrXi4P7r9r/+ppppppppppppppppppppppppppppp0GHpnm5vltvN:ANA3R5drXj1qHpm5dZGmRG3KZ97Z/

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1