Extracted

• • Target

    dbac27d5cd59776c37c8647980259fbb.exe

  • Size

    261KB

  • MD5

    dbac27d5cd59776c37c8647980259fbb

  • SHA1

    81684544284fc77f2297f39fdfb004f835c7f55e

  • SHA256

    918f09129def9a8720ce512b77e77161e01d76849f0c9b21ee127be1e6202ec4

  • SHA512

    ff3080b47732d9c21b914d1d397d61b741847130319e49d85f258527dbfa0eb0e68801b6c125e32a2104c1227c149dc0aa0b35140ec975783636731631865010

  • SSDEEP

    6144:/FE3i2rmViqjnp41UPLaxuZ2/V3UeyxORlFWGnP6MxT:/FiipqGasMkdylvnd

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2