Extracted

• • Target

    94c7dc9f9d87abdcd8914c66caa72405.exe

  • Size

    258KB

  • MD5

    94c7dc9f9d87abdcd8914c66caa72405

  • SHA1

    f7ca918331bbd0d6bd05c21979b0fa4f2fe1e0fb

  • SHA256

    69d962a08c69bee560dae12bf7209a36a8a919bef0b65bf8277c823a5c4e1fd8

  • SHA512

    d3fb24c05f1e4df7a535919431042ce2309d83d521a69c67a82c15a2504109b3c20d821b4e67eb7f9f5b82e8d928982349519c1e5dfc65e367ea33712ee5f6dc

  • SSDEEP

    3072:EfY/TU9fE9PEtuDbm5jjwHnSEVrvz5r67A3YfmSFkqff4CdhhM76YCoAhwZfBu9a:SYa694fKnSSrr5rkN3bW7dL3u9KARNK

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2