Extracted

• • Target

    a93f870ec5baff88edb4a49b7e1166c6b604c152ab6a49b232ddfa0eaa371886.xls

  • Size

    69KB

  • MD5

    9c500aed213cf9693c7e93a94e4c4b12

  • SHA1

    955c61d7f667fcc01780be2124eace8988f423a4

  • SHA256

    a93f870ec5baff88edb4a49b7e1166c6b604c152ab6a49b232ddfa0eaa371886

  • SHA512

    62dacbd2d51d5d6b20c83914d2c3964161fa9b65a6318998f5d8392bfcc618f31299d401fb8de010402a45c59682022be8d636f559aa293c28900da86e8ff87f

  • SSDEEP

    1536:cKxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAzXo4inBGp9tRG52yriu1CVDs:cKxEtjPOtioVjDGUU1qfDlaGGx+cL2Qz

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2