Extracted

• • Target
    ANDEL ORD SHIPMENT - REF6262022_XLSX.exe
  • Size 397KB
  • SHA256 933aa9ff331533ee82a1d70637f87f67df0e2510799f30e0bab35bc75c0a48d0
  • MD5 62243d187e189f1f193b7ebb99d45a8f
  • SHA1 2cfa0c2693e99a3d646e214cce0c7177c21b4b19
  • SHA512 b058a789970067ca2dbf03f480d27c2bda169bf0629d74d3481238e44d4e9b93f294e49f6b19f6db553c4f23f1737df5abb9f95286f6d59cf521e61ea722b8b4
  • MD5 SHA1 SHA512

  Score

  10^/10

  warzoneratcollectioninfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2