Extracted

Extracted

• • Target

    INVOICE 00082925 -1y.doc

  • Size

    1.0MB

  • MD5

    3347d22680185efb3cd73d55b55a5c6d

  • SHA1

    36f0afde99cdabe38dbe7c281b61c17b1ca41372

  • SHA256

    5f815bd7f39cccb4b92bea3d36861d6844eeea3307e86b237d794c660d1305c3

  • SHA512

    54cd4b8033702d2192fe8d860df7a092a23675e1bf6450f5cc3862346ef6f078b6b3de03da81d246284adf8f7a9362909fde5efa361ce9135e9c29f64a0461db

  Score

  10^/10

  warzoneratinfostealerrat

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2