Extracted

• • Target

    31a4a8eb7a0c38d7c19813b4ecd28826

  • Size

    579KB

  • MD5

    31a4a8eb7a0c38d7c19813b4ecd28826

  • SHA1

    424ce4bc49c70e89c0df7bf2f403afc18d6f9e67

  • SHA256

    7bb1b08b2a67bdf7827c6b788f47e302250c8f3ed8175d3a9ee396980d80c0db

  • SHA512

    fe2de606e60869b03d51ba0cb713f18ae8faa91ff9c31c14112606dabe781ccd8f98732296352905906b2c5950d2b24723ce9f757d790c104cb9cd585f442dd7

  • SSDEEP

    12288:OUOycCPEyAgcmFcvkrI9rzEs0sxD+ibZD74Djhe4/DIEVuHJub7U2RBVJ:fOycpyAJTkEPEs0pibZ3ogeDI7Hkb7Bb

  Score

  10^/10

  warzoneratinfostealerpersistenceratupx

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2