Extracted

• • Target

    OQ_PO_4500148488_Rev1.exe

  • Size

    259KB

  • MD5

    5434606b4299d30ef9ba8d4ddafe3e77

  • SHA1

    3bd6309a6ef81b54accdc5cc3de3d07b9d677ef3

  • SHA256

    322f8919feb65490f33815c92b90a96ccffd0a050d0ae491c360c498f3d2612b

  • SHA512

    aef8f2f571d5ca3759a402b7410abf6a33c62736db12261c73dd4ccb045ab22217688296663e37155eaafa876e60ec7ba7faf9dda91e77f25e1a19074b483c7e

  Score

  10^/10

  warzoneratinfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2