Extracted

• • Target

    276a8d7d8ee2bac0e2843dfd77ceb44e373f5b8c8f9c5e7d2730d158aefcdf49.exe

  • Size

    1.3MB

  • MD5

    409cb5edc97adc8dfec40f7ef4a58c17

  • SHA1

    deb48343ad4746ea44457f382a6e43c74aef5575

  • SHA256

    276a8d7d8ee2bac0e2843dfd77ceb44e373f5b8c8f9c5e7d2730d158aefcdf49

  • SHA512

    35baa52144e9e2a1a108b1679cd486dc0c3dd72f408be8affb0fec99e83682df31351a789f6113152be3a4f92c879f1d184f1a0c62d42c2196998ee0721d5dd5

  • SSDEEP

    24576:pAHnh+eWsN3skA4RV1Hom2KXFmIaC3X3N5Yh+jR7Kup/h7K96j+5:wh+ZkldoPK1XaCH3N5F2upxK96w

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzonerat family

    warzonerat

  • Warzone RAT payload

    rat

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2