Extracted

• • Target

    file.exe

  • Size

    308KB

  • MD5

    a24100782a9e93d92d074ccab972bd18

  • SHA1

    dc3cc1275589c9ba74d372fccedbe10651b1b7f4

  • SHA256

    1acb33d44ff0dd6c5574b9546e688cc401a390510c7d3d05b74b47f8118272ab

  • SHA512

    058515e0886704257acc932dcc663486d51be8e94fd0835dafe42b67a081aa8d9e8b9df379fadda13952cd92cc56e91a5586851df49c32a69205446acb122c74

  • SSDEEP

    6144:ypqemkdOQLTNm7IGbuaQ3TJIwUzidxRu8YKk24IoJ8LU:yBmkdOIhm7wUic2RG

  Score

  10^/10

  warzoneratcollectioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Sets DLL path for service in the registry

    persistence

  • Drops startup file

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2