Extracted

• • Target

    aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe

  • Size

    275KB

  • MD5

    d2928a656a545e09d4103532e69b7e98

  • SHA1

    5caa4825462ad5a83ba8f16b284d8e1365a5c05e

  • SHA256

    aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857

  • SHA512

    7778ea634a514812b6be6c826920d33a1c7bb05e74c1e5758308aa51d83cdb14e8fd083bc84684b8f68a3cf5753b580b8c285bfa3e7fdbd08947ca3670f1d451

  • SSDEEP

    6144:kv5oW4iOVCMftXU6JlD23CibX3cC1krm/rxfPDlS5SSGbVd:O6VXU6bKygcoku3P

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2