Extracted

• • Target

    PO100223-JORDANARMOTIVE-REQUEST FOR QUOTE.doc

  • Size

    3KB

  • MD5

    a987537f359de9010905273f3d1bac6a

  • SHA1

    6dcc57cd338b5e3ebe59dbb8b5167ad9a4e21b7e

  • SHA256

    3077eb11b2b577d6d22fe5efaa8728192132a62a821dfe81af9f5626091c84b9

  • SHA512

    8e58e054234b4cf722037c00b5bed9e9aaac296481fc20849eccf075c41668575579ad1fdd41e623d04f31e34a612caffc9f98abaa9ed37082151b303f09d39e

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2