Extracted

Extracted

• • Target
    c6f60cfece5d90cadddcf91a33fb5252.exe
  • Size 147KB
  • SHA256 28aa8ae80960e14db5f893829a24ca7ad2d184acd8a5626b524517279fa2cff3
  • MD5 c6f60cfece5d90cadddcf91a33fb5252
  • SHA1 3616621144f6c9b1866527cb18d181204d69dce9
  • SHA512 b41d1d2ddab2ca8fe12f6bc09d7c0abb93fb5e6f69dcc150aadfe5294d8959cc0310c1933864aa601000f64afe66ce90e84a7f5d83532bd23b704d6721ecbf97
  • MD5 SHA1 SHA512

  Score

  10^/10

  smokeloaderwarzoneratbackdoorinfostealerpersistenceratsuricatatrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata

  • Warzone RAT Payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2