Extracted

• • Target

    Schmitz Tools GmbH-005-008-02024.scr

  • Size

    39KB

  • MD5

    47578ab5ae24972fff800c7c4c57596a

  • SHA1

    6628422fe4aec24d966888f8e25808196f32d641

  • SHA256

    3fb3973f31277596f7e5fe245acb1e864328376d7162d6c6564fb1a438c97792

  • SHA512

    3e70e118a2aba02963f2141871513670c9ebe7886bc0d04739a17e2d01c215499abc485d7550588cceb40c840b485702f4452acdda2a58a001080963fd0e446b

  • SSDEEP

    768:Z32ctjbW3Drn6U5qUSmG1OW9aigMYIUDP2NpCiTEyPW0I:Zx5bADrbqMG1NwMYH4DTHbI

  Score

  10^/10

  warzoneratcollectionexecutioninfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2