Extracted

• • Target

    CamScanner_PO#44070_Ref_989462 PO#55088_Ref_90411927.exe

  • Size

    877KB

  • MD5

    80b19ac73aafce17ca375242ba9eb321

  • SHA1

    9e8d0906490bfa2bf3c95241a4a190837980e9ef

  • SHA256

    38fb16c57672bbf11231b5671407d0d0e2c5025bf4fb38cdbb9d427732748489

  • SHA512

    26f5dadcf055cfa0092379f7291f4645b9dbec328d54fee9ba115a26f1bb91fd3d8d29cf154f48465c8e33eb02ad71344834fd46c942ca4128b227586a4c7929

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2