Extracted

• • Target

    Estado.de.cuenta.xls

  • Size

    67KB

  • MD5

    0e3fccb0710d5f645343f0e2085921f2

  • SHA1

    e9122949ab988638db6d8c0af8817b6ea9aa32a3

  • SHA256

    fcc55ce7ed8adcf68a39bcd131de11e4be7b55899f35614fc67b4ce6ae0d6c0f

  • SHA512

    70bfff4861e49b25fb7cc9eac296d70a84c6fee9f30091efeb4c5ae364d34fd9ce034b4e15d96013093c9fb3eadc1f850d73e9df63749e3ba6df57e8d853d6db

  • SSDEEP

    1536:bKxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAzXo4inBGp9tRG52yrTQhBlKjq0LOTbl:bKxEtjPOtioVjDGUU1qfDlaGGx+cL2QE

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2