Extracted

• • Target

    2_Quatation_SKM-C659210425025802_Invoice copy_Pdf.pdf.exe

  • Size

    1.6MB

  • MD5

    42ad47286b8d197f0e0f441d752362c1

  • SHA1

    66d42a0f9d797b2c8fd27132d2b42e1acf484124

  • SHA256

    aa6a2d08bba4dc0149088f482643af47721a50013952548fe15415ff481a922e

  • SHA512

    365bba4f02482248bc981aa4b80f6c11968452479e83b952f14e631119909774600a69bbe8163a630e5413df4475bc0fde034bdd61626cf5dad2a47decf0e246

  Score

  10^/10

  warzoneratinfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2