Extracted

• • Target

    DHL DOCUMENTS No_SINI0068206497_PDF.exe

  • Size

    806KB

  • MD5

    212f8cc8065d07df0055acab1dfb9d97

  • SHA1

    49b740014d0dc2aabe52e96eb9c502037df2bd80

  • SHA256

    7ab85ac83d63559d24659167d6ce9581f48304844b8ad799dad47a31311e2c9b

  • SHA512

    2366a19e289649adff79c7d1180e78055ca649478393cab665638429d98681d554a0898c3ad1547e259b4607d9076a715f8d06b19ec361725acc849f64eed09a

  • SSDEEP

    12288:I2TpWuXJM6iiguuUyREh6ZCjdJ2oQZ1DakzZwP5BTNdAL0++:IopW+JMjNZCjXzQZ1DakF8pNuL

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2