Extracted

• • Target

    b082e39f8d2c377a424bad195e9d9e1e.exe

  • Size

    132KB

  • MD5

    b082e39f8d2c377a424bad195e9d9e1e

  • SHA1

    49a35e5e1694198d927e92c449c72a6f1ec81dc7

  • SHA256

    411763b0b0062ddf7c633c18e282527b82b23c099492af79a9cf22cf95ee0a6d

  • SHA512

    16f1f7182244df8c1ec6f0ce87f0718965de0d58e8e93be1d6fc77f2d5f00ac30aeeaece1bce7c82e1d290ccfb7af2af8db0815fd054c8a3da920d17fa4c73b9

  • SSDEEP

    3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2