Extracted

• • Target

    295f71220bf75ffa4c74ec9e8635e8775be9709fac617e919bc09e65175ff1d8

  • Size

    221KB

  • MD5

    45cae8b30bd34adaaae27bfc1a716e66

  • SHA1

    bcda483d2f56b3f5fad42e4e50e4abba5ef4632f

  • SHA256

    295f71220bf75ffa4c74ec9e8635e8775be9709fac617e919bc09e65175ff1d8

  • SHA512

    a16c3b3caea74409281006accac29967bcb4cf480bbc91cabcfcdba1b4b2f39b17ca0565f2a616e26ccf207e5fef28ecb580a3fd9b592c80636bc54c3ce82fb5

  • SSDEEP

    3072:/mt9G4DqpuiR/QltJMXn15PfEJk3w3t3rW4l248V3FMrF4M9OG6Ns8mcQ:HlUiR/QltO3PfE/xCVdKrL9Ox

  Score

  10^/10

  warzoneratcollectioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Sets DLL path for service in the registry

    persistence

  • Drops startup file

  • Loads dropped DLL

  • Accesses Microsoft Outlook profiles

    collection

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1