Extracted

• • Target

    0x000a0000000133e5-57.dat

  • Size

    98KB

  • MD5

    4413d2656402a6574e685927de745dce

  • SHA1

    722bab9a0653a2f1f8b3079185ff415bacaf5dcb

  • SHA256

    bfddc619a25d62d78ea685ac1584e93a7dc0f909893aa491c799bf1ffbfea230

  • SHA512

    45f92fac5670f6be7cec6b67df5cc1aa20d1e662c9324c0b193a6d25c9e454f62ffb3859fe46b0d538d746b4692d7dae83cfcf3e0a907c7a901843db3753c104

  • SSDEEP

    1536:5Csejmb+6BQyusX1UjtA0uWRf/eloc/9T1jVEyp:AtD6jSm0uWRfCogTjVEG

  Score

  10^/10

  warzoneratcollectioninfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2