Extracted

• • Target

    mb_mw.exe

  • Size

    408KB

  • MD5

    f9e2cba1859363981faf603e31397d16

  • SHA1

    b12b61363d3150388ac554f0bc46d00106c9dfa6

  • SHA256

    bad970e9402f9d346e7c58c42253bcedd6fb6ccda7115194ba9538153628778e

  • SHA512

    60459a9d38a576d85198de144a8aa683acd06a8f8a94e44350cf5262d31a57262281fd9bd3a525a061c3cbd3331b30629357da164a49149df09e33bc5e0e3831

  • SSDEEP

    6144:j0mi4eWGUSUm5FGNMgXDE6PXDsBRHJeqfqdNfN7nIhM1XDsBRHJeq:op4eWGRPgCADtzwHJev7hIhM1zwHJe

  Score

  10^/10

  warzoneratcollectioninfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2