Extracted

• • Target

    24fbb1253fccfad541a84636d462d649ffd2a8786c4d81d298ede979853bb205

  • Size

    1.2MB

  • MD5

    6e640d9055e4426295962a941c3374c9

  • SHA1

    58c09e5eefe0d8c7a627fde7e5da11a3165586f0

  • SHA256

    24fbb1253fccfad541a84636d462d649ffd2a8786c4d81d298ede979853bb205

  • SHA512

    6d53465e987ccc2829e70e3757429e10ad40ff84e74ada45461b11467e0f3346df6150929a3662864682987b980fe0fc1b6c5da3f8a10613ffbe967abc6f83d2

  • SSDEEP

    24576:bAHnh+eWsN3skA4RV1Hom2KXMmHaaIyjPcme5v:2h+ZkldoPK8YaVr/v

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2