Extracted

• • Target

    PO46723.exe

  • Size

    510KB

  • MD5

    3426dbb2593839db1c884ae8aa747111

  • SHA1

    6ff07e2124f761d23039c667101915f8c54fd836

  • SHA256

    000dd50b2f3df84aa499e38e8a88994b92c14556c517cd26237eacede1130c3b

  • SHA512

    0527f153c7bfc01a2a0e85f3231f9840809f708b965fbced2fb1be1515d6aad4ee384262a90cd5eba0f28b5f79ad7c8f5e1f15ce25d420784031d20b4e3e20ce

  • SSDEEP

    12288:+J3IU8S6eUdQv69QFG6wxFOl4DIzXWBNoml4tcYEIOF6mFbmW:+hItSAdk64fo6X6l0EzF6c

  Score

  10^/10

  warzoneratzgratcollectioninfostealerpersistenceratspywarestealer

  • Detect ZGRat V1

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Warzone RAT payload

    rat

  • Modifies RDP port number used by Windows

  • Sets DLL path for service in the registry

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2