Extracted

• • Target

    613355f77c2dd5064b640d8076626299a4f023512d9ee9301c674995f382b88c

  • Size

    347KB

  • MD5

    773fb681c3115952129dfab8a192b111

  • SHA1

    6cad9d1d3f6d3607bc8dcd388c972056c6184dc7

  • SHA256

    613355f77c2dd5064b640d8076626299a4f023512d9ee9301c674995f382b88c

  • SHA512

    ffcaacf102264a20fed98bee11b15ade13c98062e42f70fc52d73897adb278b6c2f96e3cfce0993d9f94d31bc1914f7ac3c017d30de704f3a002f84b2fb3f3e0

  • SSDEEP

    6144:HBnAU1X9Tel6FV4aUR4VC+S7VK85ibLbSu+:WU1+6FV494iJKJfSu+

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1