Extracted

• • Target
    T49900783-Confirm-20220126-788088-Email-8700787.exe
  • Size 869KB
  • SHA256 4e837a08dd24b1f710c6fce10f974a49141decf103d6aeb290c0d36bba75121b
  • MD5 4655448051058c4ba29f69a8b78003d2
  • SHA1 b57d558c87429777d650cb47b283d3379c4b92d6
  • SHA512 4f27e488782fee77ea445d51c9df9af677c9cb37de727c4765c02e7ccfe40837fd321a119ab2b622f7e90682cf22e22bc04d347f39d5a1505a025b6a18c12e9f
  • MD5 SHA1 SHA512

  Score

  10^/10

  warzoneratinfostealerpersistenceratmodiloadertrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ModiLoader First Stage

  • Warzone RAT Payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2