Extracted

• • Target
    Drawings & Order Specifications.exe
  • Size 379KB
  • SHA256 20139c79820552c3173bdfd0ff0ae7fefad18bd716bc3383bc1092eba1514e11
  • MD5 431d2d925a8c83260110333a1fd74304
  • SHA1 354143dc657b586809ff072cdeb97e599a10d8c5
  • SHA512 b8aaac067f6f13d7482173c0d8f34883d3e904cb38a39f3852848e767b162b2d6c8e838ddf6bda0e1d887a7385f12c157235fedeb3de8e727beb10b3e9d1a477
  • SSDEEP 6144:cYa6Pa+/QYcQqqBPjw0NsZ76bbCAAfhzWLHBTFN+eDAtvYsa:cYBX9cQ9paZ76bbCnhzWLHBxN+W
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  warzoneratcollectioninfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2