Extracted

• • Target

    775385bc6c4d8a59c167514aeb97c80856da11429b0c37db22c808908c4de73e

  • Size

    233KB

  • MD5

    e1f0900fd5e06781b90672ac17d93183

  • SHA1

    d661223516d41c3594be6a4bcea6bcb52e5b227b

  • SHA256

    775385bc6c4d8a59c167514aeb97c80856da11429b0c37db22c808908c4de73e

  • SHA512

    52cab432d51d42c1a5932366f481f651bd33512da924b3f375723260243739a52fea581b21cb730850af3567dabe66de520b73efb197b766e810c10682422f30

  • SSDEEP

    6144:G0G/OX0qr9tnMZD37F0xiwBP/DGDMDSj:4/6XxoqxTPrGS

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2