Extracted

• • Target

    3aafd49e8b45da7b71ac8e6223e86bdccb9f81f979312b66a0c6bf9b28034de1.xls

  • Size

    68KB

  • MD5

    76cd88a1fcedb634ba92c2dbfe23f347

  • SHA1

    c9d4637805cf01662d01468d9c7b4af6779f04e9

  • SHA256

    3aafd49e8b45da7b71ac8e6223e86bdccb9f81f979312b66a0c6bf9b28034de1

  • SHA512

    a0b81d373efd1844283718ca3999f7b34f5862a84043792660a31d13a1054033b0903d45becfe2a4c46ce1e847c84c6aef7ce32b91029abfac06bf5daf0975b3

  • SSDEEP

    1536:LYxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAZXo4inBGp9tRG52yrrFL/+q:LYxEtjPOtioVjDGUU1qfDlaGGx+cL2Q3

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2