Extracted

• • Target
    a8a83660ed3a1903b40f935a7b6b9170.exe
  • Size 113KB
  • SHA256 bde560e8a84bef5b1422ef285963f29f653c683f96e3b83c40e81c41fa266d2f
  • MD5 a8a83660ed3a1903b40f935a7b6b9170
  • SHA1 45907b85fb885f036f207191b74067cc2e48556d
  • SHA512 5fc316831adca541a537c082e01701f635a97718fae91ebc5aed81d87ef0c72e524c80e1aee86b73b67b4d226dfb20e37ef5eb2c345e3c0899dcd30850849577
  • SSDEEP 1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  warzoneratcollectioninfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Sets DLL path for service in the registry

    persistence

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2