Extracted

• • Target

    2025-04-15_b4070638b7dedb3315b7ce678e52dea9_black-basta_elex_luca-stealer_metamorfo

  • Size

    1017KB

  • MD5

    b4070638b7dedb3315b7ce678e52dea9

  • SHA1

    80e1bc747732472f7dfb985693003e1123342840

  • SHA256

    c5ec564a1275e6601d4806d7ec3f4f207740c09e11bfd1a314cef26d86480b92

  • SHA512

    b7bd2d07584e45801f4904bb3736c145642be3f7ef2c96239820625492e1895a345707d45e6dc1dd7e641771c0a3783fda9f99fc2b7eddc343370d22d83cb489

  • SSDEEP

    12288:9crNS33L10QdrXi4P7r9r/+ppppppppppppppppppppppppppppp0GHpnCbvltvN:ANA3R5drXj1qHpCbdZGmRG3KZ97Z/

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1