Extracted

• • Target

    Nordsee Energy Project _Firm RFQ_KE-24826.exe

  • Size

    512KB

  • MD5

    2809826395c861f78f5e756c7e1bdb12

  • SHA1

    225eb69cb85fa736158a703a7ab21dd2c0aa8550

  • SHA256

    5483462ebe9bc5efca3315a9f2ce6a82f0469980e164aa16afecac9ebf13b57d

  • SHA512

    0736ead7aece7cfa4feff1f34f2ea381cb153b6ffcd81b8fa9f9cd7bd7b627ea776fa3b7b173825d185e332ea26e1759396b67583f218553fa7ec089248b57ca

  • SSDEEP

    12288:9g7kv33fhMySk+bD3T9+zsiyYoYCiMrdEmRU:9gouySH9+pZCZk

  Score

  10^/10

  warzoneratcollectioncredential_accessdiscoveryinfostealerratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Warzone RAT payload

    rat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2