Extracted

• • Target
    CHINA提单-SHHJ26070247.js
  • Size 197KB
  • SHA256 7948f29c8da354c9860efc87b920097a14b759af05fc7fb77a8d1a2074d2477a
  • MD5 2f9f8d28d4964dfa9a6da5526419b10a
  • SHA1 aad0204e98a36ae9928a272d3b65dddb520b35a8
  • SHA512 3b9febffe153a34fda93e2ee8b3a83b82545c01fa2e1e9b020de76a4b24c4468623f61e63021c523e6f2e1babca36c2c8a31a24aba5d9c52118a565805f525b1
  • SSDEEP 3072:flbuOiv82ypUcRmm8v1UaxugnTNYbe1UNMS9+zKaWnxj:fJ5E82ompbuATNYbe6NT9+zKaWnR
  • TLSH
    T199140F4526C9B45C33EB1BFF3A1FB1E5F86B08D964484546C119F8B8B262706F8E2DB1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryexecutionwarzoneratinfostealerrat

  • Family: WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2