Extracted

• • Target

    76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5

  • Size

    5.8MB

  • MD5

    7d01ed506f8b0f279672828a3831ef7c

  • SHA1

    8dcc4d789caefd438f44615059dc0f4f47fa29b0

  • SHA256

    76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5

  • SHA512

    7ad7764dd2de059d40058d577d88a7d4bb65e491bdc8773b80c553f26c960b629e482abbee74973f7b4cc809e555d74c9388990607822682b302148da3ebda97

  • SSDEEP

    98304:zpy6b+a439EQKfTRjX6+mv9CN5uoZI/Qm3nOR1ymm2iojZ/4vLp73lhjkE6RfAAX:zpy6Hf9jq+I9CFI5eG4Qp7LkEafAdo

  Score

  10^/10

  warzoneratinfostealerpersistenceratvmprotect

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2