Extracted

• • Target

    rUienrbalkhdy.exe

  • Size

    31KB

  • MD5

    fab2eba0f5683ce922b6c2f9e5181e23

  • SHA1

    02262d9147e7930eb50c687ede1ffd0cb5d68892

  • SHA256

    daf0f1674f1796eec5b3a386424ab8e8818513f45c6e7257a2ab163c7c95087c

  • SHA512

    e9c68fe5435eb9101c1afe9f8e2ae1a20774178eae0ef59ed986a5fc8750d9eef7621783b6200ba3d914baca86298db4151d8202c2561d77ba2d2d61031384c1

  • SSDEEP

    768:F2dwnmxKPky5Oe58zwWXMdA5Vcnn9z1X:BdvadXMy5GnnN1X

  Score

  10^/10

  warzoneratcollectioninfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2