Extracted

• • Target

    89e7172718c810dcea7dd152a7a2f776f765c52785e827a0d431ff5e2bac2e37

  • Size

    13.0MB

  • MD5

    420c7466d4bb7ec179068c032a19ad31

  • SHA1

    f49b558016da2eb0c6e0207444b3c2f1a55f9012

  • SHA256

    89e7172718c810dcea7dd152a7a2f776f765c52785e827a0d431ff5e2bac2e37

  • SHA512

    5a3b29d9e06522b63f9bf5856186086a00792f032fabe29cfe6838af54cb41b670455f1694355cfd3839fba4c83255eb7994b871499d85791917e30561f34dc5

  • SSDEEP

    12288:6HxsvGS/ePX+g7R0PJQLAoKy7EpGIzEHJMHty:mKOS/ePX+Hy7EpBTty

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2