Extracted

• • Target
    8524dfc73a322ddeda2681ad153ae582ecc4a9e5ddb1fabdfaf99039176be159
  • Size 1.6MB
  • SHA256 8524dfc73a322ddeda2681ad153ae582ecc4a9e5ddb1fabdfaf99039176be159
  • MD5 77e64bb41222c5b5c8851b3f13885e31
  • SHA1 f0bd3147531cef439a6e2663990e12ba8157f18a
  • SHA512 90f0bd5d666ecfff0d0be9e09fc6d1b8b6f1bdf7298c30236329c4390f8c6069abdb6afb8a708890adc61633b4709d1eb5460c2d5de2d1880e961ebaa42f1edf
  • MD5 SHA1 SHA512

  Score

  10^/10

  warzoneratinfostealerpersistenceratspyware

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence
  behavioral1behavioral2