Extracted

• • Target

    order.exe

  • Size

    399KB

  • MD5

    a3806b87af0dbad78a129000b27dfe59

  • SHA1

    f0ee2d7d4cadcafada0c1eef5c549b190ce8ce86

  • SHA256

    7f53ba6aa86279314f0b87b531f3de2c94b78b2d7ed47580d81825a103c8c668

  • SHA512

    4ff4876675b1d69a4e31a7db38a12bc7ad998916699793deccd980297d7f2675ae2310e71013cba023983ada501d93f79458cde5e26c2eab889800563348f89c

  • SSDEEP

    6144:2bE/HUmhAp081nNxvOjqKoeKRe3liuzpDFLy5FhO3FNf:2bS6nvmjqKoemD0pZFNf

  Score

  10^/10

  warzoneratcollectioninfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2