Extracted

• • Target

    75819abac26d3f25688715697c14ea10.exe

  • Size

    803KB

  • MD5

    75819abac26d3f25688715697c14ea10

  • SHA1

    2be013e7f9988bf6c00193d1479a276d080fabcc

  • SHA256

    0ef9a5163ff41cc93ce7ad3ae8501298ac75eacfbd8395d3ae3f72b2586b746f

  • SHA512

    33b257d5dd4c89bf2326d76e84604c3d1dfc0e34201ae01d4d3846173da6eafcbe472588f9d503bad2f40cc15968dfedac3cf5316cdb31b0f03bcbdbac02e328

  • SSDEEP

    12288:2oAviU251k9btMOKdACf8uHts5oegqVBQva5TsyhdgxJU25:2oAxoOhMVAZuHG5XbyiKEKk25

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2