Extracted

• • Target

    b84950024fc775f5e791071ccd562c2fca301354

  • Size

    217KB

  • MD5

    f4b709d5bfad5c8f2aec0e6e62740adc

  • SHA1

    b84950024fc775f5e791071ccd562c2fca301354

  • SHA256

    7db51e62bdf1edf94ea2df17c46b9ee6c4c65f0988e1416f8280e9fde9dfd133

  • SHA512

    949331ee3c58674af9b9c3efa57545689a1bc6458f45f41de11078dd7c6c53abebec423c00c7e1e7240e29841feca542a7009dce7ebe4de957c5c46bb3369c7b

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2