Extracted

• • Target

    windows7.exe

  • Size

    113KB

  • MD5

    8c5693544eefeef29423f20b3b2abaf8

  • SHA1

    67bfe01d75d1dc6f952089f2872f51dd02803bdc

  • SHA256

    617dfa640a93ce037bbcbe9bf4106cc9c9ea2049020f131afa500fe0c2630d73

  • SHA512

    1d627ce12f9e4a9405154edf6671dcedcc71714a774e1c8bab8c61cdd6f82775706b819f68147ef8dc2bc58284d05d64de1579779583d9b1ed5773a4df03d21b

  • SSDEEP

    1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2