Extracted

• • Target

    Scan_9281027361782_Swift_copy.exe

  • Size

    19KB

  • MD5

    d77a90d2fa369af90578e17feb4275ca

  • SHA1

    349d9d02476721f6b89a721c523820e504918614

  • SHA256

    2083d868972386aa9b3b423b6bba7ba92c65323b1d4dfea6f4cfa19435f26a4c

  • SHA512

    c64b3663ed93fe8cd41ffd25ea4d8cff9d2e4e0845e60aa894d06c7679a662dfaac34c8d6d6e5dd3a106a20bf4b076826a840d7a28878e32c5cda270fe6bfc10

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2