Extracted

• • Target

    Purchase Order_PO184729.xlsx

  • Size

    634KB

  • MD5

    0857e270a22bef612c48517e07e00be2

  • SHA1

    4b432ed73dc559038ae9478fc86d94e838db4ad2

  • SHA256

    76403ef39cec24f8aa7e8a428ec7b05af2feebb5168e402f4244a6bc94a0faa9

  • SHA512

    cc2b9250876cbaee34dc5912aa8957d9acdadc27eb0fb0f7793c4062a9c818a3adc0b94436ea920ad98f2d83228861bc4669568b3e18d0fb7345fdc715e3d49c

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2