Extracted

• • Target

    3386f42cc721bd4da6af93cdde0824ba355f05bc6901bf99c90f2f254fff7e98.exe

  • Size

    5.1MB

  • MD5

    333662bb359f77dc06edec4d23b6451c

  • SHA1

    47f662bf56879afe6d03977f2de44b8f08ccd248

  • SHA256

    3386f42cc721bd4da6af93cdde0824ba355f05bc6901bf99c90f2f254fff7e98

  • SHA512

    54f71ac3f61ba2553f293e4a52d319071aa47820e3e1bbebb43f1811326d036f5244aefd3853cc97e8eb5e9ecc1cd813cb938ea9de16a1692bfb5073bdc4d6b0

  • SSDEEP

    49152:HbGsqmReRRKtdF06Brmci4F+Jyzunn9cAJ/g+fmkVB/CuofcFEVLiTmO3gVTpvLD:uEdpky8Cyg+fmCB6ueO3YfQL

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2