Extracted

• • Target

    0eb1c727cb604fcaf30556be5783afb142e223d5fe037af252f98cbe1d0a2803.exe

  • Size

    604KB

  • MD5

    710be6c7edbd56231c80ea627e7614c9

  • SHA1

    a3e4aba67d90ed15872263756b48623f86a83067

  • SHA256

    0eb1c727cb604fcaf30556be5783afb142e223d5fe037af252f98cbe1d0a2803

  • SHA512

    8f54051cb8a265feb0e222fca0211f4c63272a6426cfe66a9ce70a5d8985fdc985ccffe8c69ce8dd2912b717d28dbb8a6f10dad486f057d7cf865e8a4a5a0662

  • SSDEEP

    6144:mYa6OipsvVVAkIhUqsVZjxNNp+Epb/HpS4YSamRW1OeUgSxXbI5:mYxZkIlEx1bpjHA4YYRKOeA1bE

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2