Extracted

• • Target
    Thanh Phat International - Products list & specifications.exe
  • Size 566KB
  • SHA256 2e38dbab77effab3cbfb5ab6df78a76e157aa1f5906157fd1bb73252c30251b6
  • MD5 40c3dde32335244e5664f13bfe4a9f92
  • SHA1 ff9ba2a3546abc8e338d6836d1382c9960cc6a64
  • SHA512 0b684e446b8d9f86d42e6c697016c234b6d9bbf26650ac491c7314d7ee1f9d43ff493a493ad6e8be4435f51d1d4b04b624b6c15e2fc80e8fad651a6b6645f3dd
  • MD5 SHA1 SHA512

  Score

  10^/10

  warzoneratinfostealerpersistenceratcollectionspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Sets service image path in registry

    persistence

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1behavioral2