Extracted

• • Target

    Avast-install.exe

  • Size

    3.1MB

  • MD5

    c0096c0b89bd0f639eda7ac0c2ace030

  • SHA1

    e470692a6e9fe2533edfacc9646b8b85a63e39a8

  • SHA256

    a90d8742974ccf9df7d736eed7b071aa280c614368dd18114edd8384d9506621

  • SHA512

    a0e53925fb081937130f1d6fb60f448edde4d6e4fa80c88167459931eae023699b3d2e593b41a22f2d6dd93f51056c0925dc0f3b91d086f23c4d9bef060d4651

  Score

  10^/10

  warzoneratinfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2