Extracted

• • Target

    c79b02b155cc374c36acec0550ce3f66dc139eb7fa2bf84c7f9f8bcf45526be9

  • Size

    141KB

  • MD5

    b10ff5274a226f7a809690f0a59b34b8

  • SHA1

    c08ddc2dbdc50afcfc4a35893da1653cf1e51ce0

  • SHA256

    c79b02b155cc374c36acec0550ce3f66dc139eb7fa2bf84c7f9f8bcf45526be9

  • SHA512

    a6833868c6c0341b5d6442c9d26325c77b55344a9c8bb1df9310dc6b3ae139e487a8b5703eef0116718157599bcdf3493b12eb28de58da1e91650b500ff8cae3

  • SSDEEP

    3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2