Extracted

• • Target

    3df212b13323638a741a6febc79f2e426775adde00e486bc52624a23da1c53b8

  • Size

    1.8MB

  • MD5

    61bbdb549ccbc81047a83e195b00a38b

  • SHA1

    96b4d39428e9ddff6737cd3944b303f169078ebe

  • SHA256

    3df212b13323638a741a6febc79f2e426775adde00e486bc52624a23da1c53b8

  • SHA512

    d0c83db4127ac94a01cccc06492aed8e69d69e0cbffb602debbb67a2bbe3037221d8659bfd4987c8da06d7dcdb926eb5b65653385197fa3632c5a19f72a02633

  • SSDEEP

    12288:ej33yzo7xhMSK4ftKDjtkii0uuDVqMnoV8WUu1HHGYnjNVoWuLD/bfsycN01/Rn:ejyQoDhxjnoV8WUu1HmoknJ

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2