Extracted

• • Target

    e569298451bd12f37a4c93fb610b254f6237ae89eb3f573427ace46daedd1402.xls

  • Size

    198KB

  • MD5

    98136ffd902b60b1107c02cb94fc90e2

  • SHA1

    ae410c8c5d57fa37b74ff283768bd68c48dd46ae

  • SHA256

    e569298451bd12f37a4c93fb610b254f6237ae89eb3f573427ace46daedd1402

  • SHA512

    0ec2eb997c474c19d4ddedbae60552d2b71ce1b1c5780f35e6bafa089bf6a75e8fd1e8bf936ed65f21426274cffad36ce7ffba21ed6dda15b585b20b4e69f650

  • SSDEEP

    6144:IxEtjPOtioVjDGUU1qfDlavx+W2QnAo+Ly9ckwDwPq5XlsqbwxNNip:/+VkGUqLsqIi

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2