Extracted

Extracted

• • Target

    IMG_701451200.doc

  • Size

    29KB

  • MD5

    f603ab897766610aa9609935e5a65359

  • SHA1

    9800aef87722cb04b166a74ebf66f84ddfb44aa7

  • SHA256

    ef9f3640a11c9355fca84a3ded21a4e60b0565a2ccbd70d24bb4204a4c85651f

  • SHA512

    152f6be30932cfec62e7d5d596d966f9a2210bdf081e2b3da15271543d84a352e9fa2bc47bf739a7c891f180ea90c760c2c5a98db08f6b6f7ed01888015eec85

  Score

  10^/10

  warzoneratinfostealerratspywarestealer

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2