Extracted

• • Target

    9938c0da9c07f8ac35c6459e1dc988c64e10ddc70f4e95db63e34422d14e764b.exe

  • Size

    1.3MB

  • MD5

    b22d066dc7407e782268c2b465401d29

  • SHA1

    3f9acf93951ac8c569dc6125031af1e353771b3c

  • SHA256

    9938c0da9c07f8ac35c6459e1dc988c64e10ddc70f4e95db63e34422d14e764b

  • SHA512

    5832d068b1f503c1091af1b283c97fa101c4fa546c38416c9a191da684815824c03325371ef0d89666eac3e3310efe448ed7ac2810ba402e7a7bb6d533bffbe5

  • SSDEEP

    24576:du6J33O0c+JY5UZ+XC0kGso6FaR0iNiQWBTL+WY:vu0c++OCvkGs9FaRDNibVY

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2