Extracted

• • Target

    8ddb5b025db3c3e9a3662f8fe15f1a0280545615593893f075c94ac60b419a92.exe

  • Size

    430KB

  • MD5

    944d54317bad9459a0deb6ff27424b68

  • SHA1

    5f826c7a53e3193ca6ec9947cd4901ac28508794

  • SHA256

    8ddb5b025db3c3e9a3662f8fe15f1a0280545615593893f075c94ac60b419a92

  • SHA512

    2810674ca4a3611434f5b2beb5655b33c9691df5af597089a2218903c6ffc97b8ba7ad9c3512ebc6e35a17e3dc9cd624aec30d2a0412d9d67370c7053f01bddb

  • SSDEEP

    12288:Lq+eBVvFqJFTPMHggk1l3EA6mVuRRvTFnpWaCrj:xkvFq01E/6mKvTJ7Crj

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2