Extracted

• • Target
    QUOTATION REQUEST REF#E6448.2.exe
  • Size 686KB
  • SHA256 37997c1eec37f3540a10458aa1e67be3cff20ef13feea966da82ec0f99f4fbc7
  • MD5 d5dde8d50ca8261598f65244a920599d
  • SHA1 03082c5146c70cc8b2ad1e62424458459d66ce5d
  • SHA512 c6ec9b7061ddc552d183896de96dffc74db05aea44363b4f8c9d1c176b9d76a238c0288049646698f7dfee95661e8184592679517c885f2f339c9b465e59abdd
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencewarzoneratinfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2