Extracted

• • Target

    1098a175dbcd881620ff687c673c4ac3ac54f4c11482b4fe6a08515d8d180c19

  • Size

    148KB

  • MD5

    e51e575ea8a84eb28defd07e984dab7d

  • SHA1

    8249a68e2783d5432556956a6800dac52c27eedd

  • SHA256

    1098a175dbcd881620ff687c673c4ac3ac54f4c11482b4fe6a08515d8d180c19

  • SHA512

    c1904233d34fc77c84c18b19217c5cba242e1714be42ff1ad7ee041e01aa66d20aa233e6aaa9ad5b50dc685348a776eed4aa5573974c52d77d522c1747ab4f44

  • SSDEEP

    3072:hUJoFfWzzl+cQMBIQ4vMrrEAdaQWMlrurt03gwOlEnW2be2VfdBAOPQGY:hweEx40At8wEntFHFPY

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2