Extracted

• • Target

    2bcb38077232015d9973e3a398137405044967e19c50320705bfb36d5a41fe3f

  • Size

    1.0MB

  • MD5

    1afb828980cd3a0234cd51dec11ecc04

  • SHA1

    46f06f7097333a9c9ff1404c8cbd1fa99f5675e4

  • SHA256

    2bcb38077232015d9973e3a398137405044967e19c50320705bfb36d5a41fe3f

  • SHA512

    e15add9602b727dfd2800a2e77bcff81305bac579249dda3d9f1991ae9bc6a977a3a8569a9d851f623eb8c45a58a3aafa6b4e67cde630379f6090d9181abc731

  • SSDEEP

    12288:iCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgalI2I19TtY1:iCdxte/80jYLT3U1jfsWamB9P9RMAQ

  Score

  10^/10

  discoverywarzoneratexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3