Extracted

• • Target
    PaymentsSlip.exe
  • Size 899KB
  • SHA256 f0949175ee4c6e72f3405816aac82be2863b1c6a01734e5750883da1362aa5ed
  • MD5 49f570ee00750e7371ea4dfd4a274216
  • SHA1 9ec78b1a99c27c22be8ab837997cd43a7c0561bf
  • SHA512 d3d9b59627b951c55a15feb83b25b44ff2a06ba4da06e678febe20aa53f0847dcc8c2fa90cf6812642b323e82d840207002c6322cb720725513ea7f02146b29e
  • MD5 SHA1 SHA512

  Score

  10^/10

  modiloaderwarzoneratcollectioninfostealerpersistenceratsuricatatrojan

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin

    suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin

    suricata

  • suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)

    suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)

    suricata

  • ModiLoader Second Stage

  • Warzone RAT payload

    rat

  • Sets DLL path for service in the registry

    persistence

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2