Extracted

• • Target

    Eriuekal.exe

  • Size

    26KB

  • MD5

    9607ad352affab592f84993152e50234

  • SHA1

    9225e1a3aef2e5309308e1f2ea1dd4ac952d21b5

  • SHA256

    dfb877a76229db5342b35bc947a0bb12d2b5564b3567eddcc708d5e9cb4edd8e

  • SHA512

    f7b3b882cb779dac6dd55c82a83dae0a29bca6e05688658b9b021e33b76a47d6e5af30848ad9feb5351b812d7ba8f205b9969f05a65d8a7e7b2dcf43abd139c5

  • SSDEEP

    384:e5Q4kSygaDNkQVXZOxOK8MP93U7I2kGYb1ak/fbzp:yfrSXZK99AjYJakLzp

  Score

  10^/10

  warzoneratcollectioninfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2