Extracted

• • Target

    Estado.de.cuenta.xls

  • Size

    66KB

  • MD5

    0446015a22e4778816e2ccc64ac17a9b

  • SHA1

    4943e12bea20024937b890a289da2602a111a547

  • SHA256

    99577d4554ff7f8f9c98b9fd9c249f6aab4dccb47142466b070fd6d33d641e4e

  • SHA512

    96ca9e969e7864d0befff5ac56a408988b162ca4ba80cc2ed1455f4b6ee855ff4e3a0397879b7833b8279fa98c71c8596abd8f83f2107daf4bd80db032bbb811

  • SSDEEP

    1536:BYxEtjPOtioVjDGUU1qfDlaGGx+cL2QnA5Xo4inBGp9tRG52yriv+L:BYxEtjPOtioVjDGUU1qfDlaGGx+cL2QU

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2