Extracted

• • Target

    8711c0444e0e2869118f577b3e28776c75d0845691bac42cb92005cc97c62b8a.exe

  • Size

    276KB

  • MD5

    fa5016fc7fd8afb70576f945e7a467a6

  • SHA1

    e2fa696d357eda0dcc5fcee766969e5f773443ff

  • SHA256

    8711c0444e0e2869118f577b3e28776c75d0845691bac42cb92005cc97c62b8a

  • SHA512

    a0174759a66404f47a9b0ba57e38ea5b51c4155f1420908a57a17a90bae9970040feebb16c5b2e2c649eae67b38cfc920df0fdec1f5252fb8be21974b67d3d67

  • SSDEEP

    6144:FX+rDOQnlAoHWpcT9+BnMCMDCRKXUcQG8NBSgGTyqrZ/urVrrZBGMBnDF/ep9jd:FX+Hfqcp2nMCMD2KtQNB1GmqrMF9kMBW

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2