Extracted

• • Target

    57d2d440a40f5535bd0919d0096899b344451b2a41394fcc581d19dd62f1fee0.exe

  • Size

    218KB

  • MD5

    61ccfa7e637e69441e9f9dc471f184cf

  • SHA1

    bdcfb6eae2166f6d154ec66e7a4fc7240d517267

  • SHA256

    57d2d440a40f5535bd0919d0096899b344451b2a41394fcc581d19dd62f1fee0

  • SHA512

    a1a177de906eceaf4dd1a81ea953527ceb7514efd9b01b23cbf2bba8e5d364035fa1b86c6d92421df223ae9e2844763f5f926e08efad419d979f9171b2708a66

  • SSDEEP

    6144:h0Af8O9N159lfbouG4WQCbCYcHmFTaGF3tUM4:hKktljM4rICYcHqaGPG

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2