Extracted

• • Target

    a0f7b1437f7d654a31ce334a5cee80c3

  • Size

    579KB

  • MD5

    a0f7b1437f7d654a31ce334a5cee80c3

  • SHA1

    7f88e50e228dcd583d3217eee79e538982852d1e

  • SHA256

    da34048b61c6e2b2d0cfe772acba5391154e5a545d0244cd1639a770bee306bf

  • SHA512

    dc250f269878920011b4810c478d8fd4689bdfc2ffc101a86905b813da50ec8dcbe4b46c6dc4d2be43be4279be671ec3e6806b75514a5d0c9019cb9f4cd33a76

  • SSDEEP

    12288:DUOycCPEyAgcmFcvkrI9rzEs0sxD+ibZD74Djhe4/DIEVuHJub7U2RBVb:IOycpyAJTkEPEs0pibZ3ogeDI7Hkb7Bl

  Score

  10^/10

  warzoneratinfostealerpersistenceratupx

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2