Extracted

• • Target
    236eb14b78cb074e7e70e2d2114e19a1
  • Size 229KB
  • SHA256 14f2a593281d5c9700a878f32199aa69b18f10b2d3849d216764f96a3f8a00f9
  • MD5 236eb14b78cb074e7e70e2d2114e19a1
  • SHA1 c85cf74f93a693c0cfe30c2b858c738d1266e064
  • SHA512 a59974323047a25c5deca54be0581b99778dbe023a498925178e58a8cb1f230955a2864f450532f10e944e7346606e4df4dfe3cb59d3f280498788fd330738c1
  • SSDEEP 6144:BlfFlG4GX4yv2tSbQs9sZMVPt/4JrqmuW:bFlG4nyEcQsN1/4JrqmuW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Sets DLL path for service in the registry

    persistence

  • Deletes itself

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2