Extracted

• • Target

    55ee4ec7ef356d27f1de8b0a0dcaa1d0ec82657ed560d205b7685f0463347361

  • Size

    2.2MB

  • MD5

    a3a5585495a363a370682c1cdcac975a

  • SHA1

    ba053ec257b1b3602e7957af16848fb69d6cedd3

  • SHA256

    55ee4ec7ef356d27f1de8b0a0dcaa1d0ec82657ed560d205b7685f0463347361

  • SHA512

    56c54b6e83f185640eaf0fc9ee19bc8472d53455b34c9c8b3c056e8e602b75db32e5f2485ee9da538041a592f534c1202d582ee196871023a134fd8418a4c076

  • SSDEEP

    12288:axYXuBiUvOTi2TJlDrnDrnDrnDrnJrlxtGfaIJ2Lk1VwtVr06Mv+vsBwSjfwD90o:WYG2TJljIJzozJzdbanoqKBXPf

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2