Extracted

• • Target

    fb3f04908f8f150a72df754414e3a603

  • Size

    346KB

  • MD5

    fb3f04908f8f150a72df754414e3a603

  • SHA1

    b01e5ea906649f77d01264cc1cb1e451297004fe

  • SHA256

    cc47a9cd21127f53bdb494d7229bae248aa5a4140e7a70a9f6c521741f6ba477

  • SHA512

    45f782e3166fe1f2b1a2750b630ab41066f118fb4b93c9f4b52d1335fff1e54743193db39061d82757224524139da0977449f4a25c87011605cd7611268803ac

  Score

  10^/10

  warzoneratinfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2