Extracted

• • Target

    99257e66c5904573be6b6316fbace99d9cb4ac2806b88c6e1e1c04787a2f4bd3.exe

  • Size

    275KB

  • MD5

    48247108609ecc08a8a588343b56815c

  • SHA1

    b85b951abcd3ecf740f4d7b2750164cdf6b54621

  • SHA256

    99257e66c5904573be6b6316fbace99d9cb4ac2806b88c6e1e1c04787a2f4bd3

  • SHA512

    78015de9975b46969b8c3a951a01c815fcaabc96f6d47d57e7dba1ce40c0dc25b5561ccc51bb7ec15fc80e786a0c6a9a89afbbaa4ee935f85045827b8afc2c26

  • SSDEEP

    6144:VqOwsjvrCjtYzA1C4vEmOfgoUfACAXVI3ILLW28e4CPgF8KLqSG3d:1jmjiz08mTIhyaWoknE

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2