Extracted

• • Target

    Odeme_Fatura.exe

  • Size

    582KB

  • MD5

    7bee43d88ddd5717c4059960d4f7abbb

  • SHA1

    51768285fb6047a523af3d28e3e8601fa17a181d

  • SHA256

    913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3

  • SHA512

    b3043c68445d95d1794e6557d9ce096c812c631e7d43dcdfe40850731e94ed877799fd6baf162197c888d0484a07b9c8c73994b08c9844434d3f388b768162cd

  • SSDEEP

    12288:nSQ3xl2I6NRNXDrI9GeZnbfPJJgR5lbULc1tBWpK9s3FqFLtomQ:Bf6rNX1eVXjGbt1oqFLtoN

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2