Extracted

• • Target

    0008486f70d39be162bf28c0bbfe7d76

  • Size

    682KB

  • MD5

    0008486f70d39be162bf28c0bbfe7d76

  • SHA1

    05c1292697cc676f8d03ed421db89147abf707db

  • SHA256

    e1c0d70500b6aa2fd5c1e1407c96b62df5b16cf36b258e2b16e3864928d847d0

  • SHA512

    49139a468bc0ecffb854fe9eed7edf5dfd81ec53189fec78de2045f93b6b1a48b27c05f69b2e2d969f6822a3f0049d7bc07b873ebef714269bc93b350a69b0ee

  • SSDEEP

    12288:0JhG716qWqYmyDGKcq2P6ISuNBeuWnSI3qbc6WReS:0Jhc16qWlmHKcJp3NPI3NYS

  Score

  10^/10

  warzoneratagilenetinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2