Extracted

• • Target

    6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe

  • Size

    215KB

  • MD5

    5d278b330412fc5f0b05a6168e4663f7

  • SHA1

    afebf776b4cdcfa12dc38d7aab0190820a956057

  • SHA256

    6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e

  • SHA512

    4c7204ac871350fcb6c4e4a745fd2f7482afa152e0cdd7e4097aaa427d1911b6fe038b366cba5acad1243e209643634c2ea48ad4c613a34c2488eb1fcf3ef275

  • SSDEEP

    3072:2fY/TU9fE9PEtuFbzrF+aj3dFzFNqdTGi7Gb2QmBAZdWlqLGCZM4fNmBvqNxHFgz:gYa6XzrFrbDqVGd6AZdwINmlq1gqg

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2