Extracted

• • Target

    22a231b758870d819a1169a9744a0805.exe

  • Size

    277KB

  • MD5

    22a231b758870d819a1169a9744a0805

  • SHA1

    5a175eff3e50d5108f9d859b57c5be276a23ac53

  • SHA256

    4fbea9806312eece3dd8523cf6c9509cedda1abe14fdc55bf793606dffe6c053

  • SHA512

    447d2ca8eab182c29c380ddf7ba66bbb5c9ad86edd113d0771e3290146c3a187e95e4931f1ef2b89b2bddd79f42813ea8f47ef643a0ad93f8643e0ae05815ef7

  • SSDEEP

    6144:K6fjKlLXlCLVH30qRECXqo+5MuUgYXNV+d:1LK1XkLVHxGo+egYX6

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2