Extracted

• • Target

    6f791bc3f5337eb2a4e7c5adaf37590367bc615eca9b2b75d34b773252a26437N.exe

  • Size

    276KB

  • MD5

    172c44f1f2738bd2a81a490af0e5b9a0

  • SHA1

    4ab61368688f5397574626650e550a52d40492c7

  • SHA256

    6f791bc3f5337eb2a4e7c5adaf37590367bc615eca9b2b75d34b773252a26437

  • SHA512

    f6660ea523ce66a316921f7a18f4eeacbc218be43a5a46ae911d0db2534512cd70bc799c9815acbac2b3f9403e3303b05957d6fff6a9b92ddf93fad49e02b8fb

  • SSDEEP

    6144:rGtN9doKWT16SyQN9/xnZeRDfSOjcZEz3sVIB6AeuTBHtynf/A/CLd:r+WKg6dQN/ZeFHjcZqi3A3HtiX

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2