Extracted

• • Target

    78ca9bf3152dc7f36e1bfab297a8e62ce8781bc7499a9ed404ee0b4bb36bc292

  • Size

    330KB

  • MD5

    faed75c3c18841cc557cfe7a4286d114

  • SHA1

    be5eed4ba427efd178583005d3f6810f9d9e1331

  • SHA256

    78ca9bf3152dc7f36e1bfab297a8e62ce8781bc7499a9ed404ee0b4bb36bc292

  • SHA512

    d5b0f71a44eb8c06a364132220ae40e933830c0fdf497685fbabf63b91cc1466f5eb723850fe25e0925a2a674b8c5f0f9d2ba06b998562940ccb92b98207ecca

  • SSDEEP

    6144:79w9BK0uSC55XYfwtrw+cedPz30LFeuYkHfX9umZFM2Td:79sZubYorHbuYO1pMq

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2