Extracted

• • Target

    azs.exe

  • Size

    132KB

  • MD5

    a069a3dd57d62f6b592e77e96779d7b0

  • SHA1

    5d41d83cdfaf1399d989656d0d2f92152aa63bae

  • SHA256

    710026b5bbfeec7368bf8eaf568cf1d7a5d729b155daa1d336235a879593180c

  • SHA512

    2872267cb471c90dfac85f67cebaea5c5b4cb16336cc8cafbb20d7035a16fe17d9924119ffad81e18cfba9b359e6be8004b8c6920741970ec84f84b7ecfb5f95

  • SSDEEP

    3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7aF:KwpsERzGKurEXCzeLT7a

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2