Extracted

• • Target

    1f6feae633a783cf6ef08eee6b65049fe5b692c8a743af8967984e2e212a06b5

  • Size

    275KB

  • MD5

    21aea7934aee995629e68e5834695608

  • SHA1

    94e690f33e0f7b8ea8a1c665359836b363cc09a5

  • SHA256

    1f6feae633a783cf6ef08eee6b65049fe5b692c8a743af8967984e2e212a06b5

  • SHA512

    b25883eecaa34a355047c4c6c0f684298f2803e757ffb3fdc6b097c62283e96b6801cafa3eaab9eb49df79c2abefebcc5d53816b877bd9ce108864785942b0ad

  • SSDEEP

    6144:1b0neHPqlbJjsye59MQwtBakPHyxqZ3I6qGtVmIt2M3FraeLh87knbqbNyd:2neSbJOD5WXuqZ3IxGtPtBZae1M+mM

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2