Extracted

• • Target

    07472f63bdec0c4a83767d19b8b7ba19.exe

  • Size

    277KB

  • MD5

    07472f63bdec0c4a83767d19b8b7ba19

  • SHA1

    32392707ddac27ef3cb0baa8365ba11d326e86ce

  • SHA256

    044ff15e8d3c9534c11c3719bd88a8302611c697ae888b23c768cec52f1970b6

  • SHA512

    259dc8f8303b6be1fde58f090d2f628c80f9cab83be4df93b0b272e3073658cf9504acab7795df0727d900a025d9c2e5d1e7801a2f14c571f04e8b10a26f01ab

  • SSDEEP

    6144:A4qCIulquAQ40xAkvW2jxcbK9kMYzX/Qt8AsH7m2vOlPegMIOGd:DI6lAQ403vjjxcbKwr+8/sQgH

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2