Extracted

• • Target

    0b17d9f9755d73cf32a0c5830a416593.exe

  • Size

    382KB

  • MD5

    0b17d9f9755d73cf32a0c5830a416593

  • SHA1

    1c90213d38741e29e295e9e23b5700c701232f40

  • SHA256

    ec2e95face0cd1b7eba04512d1dc99faf0e06f52daf5687664ad78e1eef6d43e

  • SHA512

    1c7b556fece20fae1a2820b2a7a1898718330e40939825d2d6701db10fcdc0af81067b1387e4ddf8333bb2151b2089e562ed43f234c8cd580246e68c2ed68e34

  • SSDEEP

    6144:G8Wga0LXOzQXl+6ZzIZWRo+p9YfgOBY01SDb6XJ6HYhwaWyN8NOg2OKsyrKzosYg:G8tj0Y5hIZWa7Y2wsEYhwVyN8ObKzosz

  Score

  10^/10

  warzoneratcollectioninfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2