Extracted

• • Target
    23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b
  • Size 531KB
  • SHA256 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b
  • MD5 5e1d1c6786e123dda5600d4e245206f4
  • SHA1 6a922c6f7d02b4151c03e126b192a1c7501cc8b2
  • SHA512 6b1ee03cacffe1955526d4262c424417e84a046dfb5e8d032f1dac7cd77bb94a4ca77290c96e472875839cda59ef36a00126651c307ec0f8a84b8e26bcf089a8
  • MD5 SHA1 SHA512

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2