Extracted

• • Target
    RFQ-OM-3994 - Closing Date 31.12.2020 - MEPF-PO-2020-060PDF.exe
  • Size 1.2MB
  • SHA256 e57f565f43e5cf078529eadb7c469dcaeaf3d4fe6bea9294bb8404425c8b8a10
  • MD5 a368f40b98b34820d5bd0468569bd1ef
  • SHA1 8a1ba5e72e778c2afbb00828375c6ae6905116e6
  • SHA512 b66fa86c968e58359c646305234ec570fc56d5801d19dd1d6148f05f3527965a5acade355fcb12dbf616e2ce9d8e6f6836a62980d616fac5b00f57d62328fadc
  • MD5 SHA1 SHA512

  Score

  10^/10

  warzoneratinfostealerratspyware

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2