Extracted

• • Target
    NEW_INVO.EXE
  • Size 392KB
  • SHA256 7f21772a5af60e60ec8a64a678c5c3cd5bdf30c2dff9c314f6f7341a39ed30ed
  • MD5 ddc48cb85e1d7082584832b95abe0c8e
  • SHA1 278e4b5d30a367e0ec615366924724bc25927e1b
  • SHA512 8dffc022baf5df0ddaf946b0ae991ee005efd79bbe9389270f446c588c138865cbf84aa5a9ce8a7c80b0fac84ccc364ec91c694f97ba10a7da70497de4cc375f
  • MD5 SHA1 SHA512

  Score

  10^/10

  warzoneratcollectioninfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT Payload

    rat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2