Extracted

• • Target

    2.exe

  • Size

    193KB

  • MD5

    ec022f92355ae58272bffc434a595bad

  • SHA1

    d6e945a955beadf7fbc384d0df68d83cb1000c1c

  • SHA256

    47af206f5b28365c01eb80fa135f1acb09f99ea37dd9c2ad23d5c7f359f29e0f

  • SHA512

    6f8e264f1643e8735a26add89cd5376bc538a1616da77ed53383ef5a708c1a159ba4b037a1d965372f41f460fa61402786de11c39e381619ae3a482dcbd24359

  Score

  10^/10

  warzoneratinfostealerpersistenceratspywarestealer

  • Modifies system executable filetype association

    persistence

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Executes dropped EXE

  • Sets DLL path for service in the registry

    persistence

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2