Extracted

• • Target
    8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb
  • Size 538KB
  • SHA256 8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb
  • MD5 6e04d11045fd7e1a433ca7f6938fe4d0
  • SHA1 3100d9335036fd72eb2213b218e57e62a4c66cc7
  • SHA512 eba8b5deaa425f010534ab26f17f84002a3bee64007e6459d50f5e775753db37b6059af9cd77005a7bb6259ed9fa721ce963c45f1629bc56e6bf8f5be77232c1
  • MD5 SHA1 SHA512

  Score

  10^/10

  warzoneratinfostealerpersistenceratspyware

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2