Extracted

• • Target
    207953.js
  • Size 73KB
  • SHA256 ab9ee9d66ea198f5c199d85f7f770817d7abf8346b559388e379c3d9f2f23332
  • MD5 b98284329fa741bb2972f03f90f6a318
  • SHA1 54ca0f049e3dacfa4e6709a6df051ce3c597238b
  • SHA512 4e321f80e30a6d8d8c8b963ed023d830f52f6a75caf34dd7da9c9915d7a1c4e2ef24ab12c84239d9cfe633f4cbe7c4dfe93f4e75ce1b0b8d4f041cd731982424
  • SSDEEP 1536:/ogBdHvMUGrWyWDRvVSoCiiMZsZAcxVu9InbaZFXBKt:/oodLh5cMZ8AcxVAInenIt
  • TLSH
    T19A73004227E0F88C13E65FBB272FB8D1F5AE889A19448C4BD618F8A0F574605EED1774
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionwarzoneratinfostealerransomwareratspywarestealer

  • Family: WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2