Extracted

• • Target

    Order Drawing.exe

  • Size

    219KB

  • MD5

    ba238aab80697e0c6479431b775fd98b

  • SHA1

    c8ecc52cc128a599eecb34b51e3dcf4f5fd17aae

  • SHA256

    316defa7aba9f42e2e5adc55ba4669303c1a341b68d2e6cf8e1ae3807cbac1e7

  • SHA512

    df586609464c65db8611180694e28df39179d0f18c557806ccc32c1bfcb6ef69a1de5dd7759574f5a16a0e3663ad28da884660d2d6ef13eba4fadc08678981f0

  Score

  10^/10

  warzoneratinfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2