Extracted

• • Target

    Proof_Of_Payment.exe

  • Size

    942KB

  • MD5

    81ea748120efdf6f2b9ca5399d679127

  • SHA1

    278feed07c294c6c9588020ff7c4cdbcfa8f4732

  • SHA256

    2428a665140dcba43e5dbcffc5cebf65807ab30e3a0b4083c0f9b44b8a830714

  • SHA512

    50b41c47b14d10283126e2712c84e0186bfb3c9e9a4ac48a99fd36d78e5258a0ef3f98707a43d56cea344d85dd91178413eae3ababe4d737fa6dd85daa3f17a3

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2