Extracted

• • Target
    00f967c1848688151db02d2186ee0f94.exe
  • Size 368KB
  • SHA256 2db9768efcf9026fd5c979e9802aa1e2cdec6bebb0815aea8a77d664bde1d8ae
  • MD5 00f967c1848688151db02d2186ee0f94
  • SHA1 a9234f0205a9d178af5f366329323e3da85c4a12
  • SHA512 0683743b6a9f4b98a2027021d7f102a4c47e64f1103844c1d0e5d6ad2000ccbf68737ae8d22e74e8120ee5d7eaddb5344afc828034c63a7fed5c8826d48ee5cf
  • SSDEEP 6144:GbE/HUR5waVgIX7A7ZAjHE6N39OEZ8eZQ5K:GbkZh6N39dZQ5K
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2