Extracted

• • Target

    dfd73442708a7eda9b8e1f9ddab6333b.exe

  • Size

    889KB

  • MD5

    dfd73442708a7eda9b8e1f9ddab6333b

  • SHA1

    c0049f99bbcf808a13b01bd0bb340d0893818da0

  • SHA256

    a9354f6be9a86c64e1b57ed80cf9f7321b4e986349bdc2275f63534be8ef77c9

  • SHA512

    e3c99c42ff02afbadf0c5746980465f0a01d0ea7db14e3272e7d12bcab793690172f195c8517fe4a2835bedb6eeb363bb89d239323e9392218b1c20ce9c0bb47

  Score

  10^/10

  warzoneratinfostealerpersistenceratspyware

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2