Extracted

• • Target

    sample2

  • Size

    257KB

  • MD5

    07c86dadcc51ffcb395a496086a79ec9

  • SHA1

    db1b4ce23007f85683ff72fb6ea6821ad8a14b44

  • SHA256

    18ec681c471f185edf3ab8e23b52b4ea2a87162f9957b4d5d10ac0e2bc008405

  • SHA512

    a5327dac75b2ac00919f267594e02924ef7188426bb7f75bb4e06a7f2330cc7c3332cea9185a194017b3d9ec8053389b2ffabdbf34cb931c1e91b926c2883bcf

  • SSDEEP

    6144:K8MWRKxuE2YD+YUa1hp+V0bh9LjfYM8yJRub4NK:KMROuE2c++i0Djf18QRJK

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • Modifies WinLogon for persistence

    persistence

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Downloads MZ/PE file

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2