Extracted

• • Target

    28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637

  • Size

    276KB

  • MD5

    fe559e673d14f05af4fd51191ffc31fb

  • SHA1

    ff79f669f4dd143ef33094d087e6c289ef43a588

  • SHA256

    28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637

  • SHA512

    c7bfdebc6c5adea21387d3219a52b4b59c225b518a97bafbcad73df7c327cc03321b6a33d8b19a5b461cbc00ef43c14e3429c913b5ca49543d5e4156a79ecee9

  • SSDEEP

    6144:+8o6mYd/c76QjwExcJHg2r2Nh/qoWV0gh4bmIfQYh3912rBY9wd:+81mm/OwExcJHZr2Nh/vWV0xNfd391y7

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2