Extracted

• • Target

    e30fa7df6be2d12dd90390ccad92eb721befc297b387cf1f3dca27a9166b13c6.exe

  • Size

    9.4MB

  • MD5

    90b9800403b05be03449aed0424cadf4

  • SHA1

    bd2e5f87e78984a6f6d9cfecda5b139941731a2a

  • SHA256

    e30fa7df6be2d12dd90390ccad92eb721befc297b387cf1f3dca27a9166b13c6

  • SHA512

    2f337f57985927fba9f7a149fb3d18179e93ced98cc36b143e5532b9eaae924a6148a95aab0028bd9c23a514b83a0cb72ca78d271c24dd6626714ae168f6adc6

  • SSDEEP

    196608:08upg+GYCkf4qg4h/FQvGS8upg+GYCkf4qg4h/FQvG:0tgb4d/SvGStgb4d/SvG

  Score

  10^/10

  warzoneratdiscoveryinfostealermacropersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2