Extracted

• • Target

    profile1.exe

  • Size

    319KB

  • MD5

    cad3404a925d02d351239edaa03af840

  • SHA1

    82bd5b6987906034ab58e988a5f615680e6faf3b

  • SHA256

    f6ee358f1e50caebcdd8b92517d562009ac2a64e63118ddff33bd31d07d2f4c8

  • SHA512

    b15b2e7dbbb73272d17208764179b75782471c1a8ef16dad649a24c5e56173a298c58cfae909544629be782cc67067693e32a3c1cf961052799209b22175bda3

  • SSDEEP

    6144:bNCgPkThJIouHpmFi5DFIjKxQZCJvLKC2bSdoWGy+c3sMFdPmE1Md:b8HD+JxQZ+zXd6hyxs0PmE10

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2