Extracted

• • Target
    PO_IN00043INBOM_Specifications Sheet^^^^^dwg.scr
  • Size 379KB
  • SHA256 75a25fe05bbcefe44a5965015d178374e74b2d2be3ec2fba5d15cf37dc93df20
  • MD5 3346c56f56dd3704fae1702388f0dcab
  • SHA1 acf58fee939957b9dbb8df32b2024377328c7b4d
  • SHA512 580ce6dc543d6d97432f26e6d90b11bc4179fc794e1c24e671544808b28b4880e05987b23e440811dae7f03eeedc80a664ab5f02151d8a6c1e9c07d607db622f
  • MD5 SHA1 SHA512

  Score

  10^/10

  warzoneratcollectioninfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2