Extracted

• • Target

    Order specification details & P.O.exe

  • Size

    293KB

  • MD5

    ff347cfc7f5bc51e626366aa9099e2d1

  • SHA1

    6f4e07dd2aa8abd8d4ff4856cb7f3d1dc3549740

  • SHA256

    4732c2a4e78e5f416cf1d7abf28c1991e45ac8706fbab576b84f0b72d0288d2f

  • SHA512

    93c808d41b9863055244e42b0ab45311129d74cb94f931ff80ab0db023fab8728e261e042587c8ab4ae41fb088f11f6d5023e2dd2eda14e2008ce7ba24d25f17

  • SSDEEP

    6144:InPdudwD/cmeeEYgXrCxF+OUC2oODwgqazL8sMb2jBV+R4N0W+TO:InPdTb7EYKa+OUC2oODw0zLgbgeR1/O

  Score

  10^/10

  warzoneratcollectioninfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2