Extracted

• • Target

    457ee568e711ffec6b49e8cf166406d1d23e7d17b15b38e40f963f201467ddec

  • Size

    63KB

  • MD5

    67ce588ace5048b8d7f72e2540bb9080

  • SHA1

    e118995771eeee8fcd5d354546367b8d7aa29c0c

  • SHA256

    457ee568e711ffec6b49e8cf166406d1d23e7d17b15b38e40f963f201467ddec

  • SHA512

    60e4a1cafd972a2bbfa28e67cd7d70d7b84297cb81f387552dc7ec5c7214d4d6c1ef507d10fe698ed2c45a05983a6bc80638b38a34bd1670cbe64a0540c096cc

  • SSDEEP

    768:F6hojj04TKrzqTn01Ul5zkNj9Jb1cdcEOhuCKg4oYIZ8HKaLCtitTkGNK/:F691UeJpPhKg4oY3L0ipkX

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2