Extracted

• • Target

    935ee7743f877a6c5e94fd502c2eae956e619b2d20a8456161ea2de787203032

  • Size

    232KB

  • MD5

    da68f073722703435278e45a1a1e54ea

  • SHA1

    f7a56876b13ea85de713171f0f1c3f76a988c26e

  • SHA256

    935ee7743f877a6c5e94fd502c2eae956e619b2d20a8456161ea2de787203032

  • SHA512

    3fff540598f81d4162543e8b089c4902f9509c53a81a357155050060dd758e7c77c9e379b0f31eb9f8dee816ec7a153470367491711d39c12004bee805798f10

  • SSDEEP

    6144:b+YD77nfv1aFxU5JOtXOgfNb6fTF4MoiwBP/DGDMDSj:bBfnfdKU5J6iATPrGS

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2