Extracted

Extracted

• • Target
    https://github.com/Execteam-code/Ultimate-RAT-Collection-fork/tree/main/Scorpio/Scorpio%202026-01-15%20Variant

  Score

  10^/10

  240617af36619e727e4106b4d22b8241/k0ddrdiscoveryexecutiondonutloadervidarwarzoneratinfostealerloaderpersistenceratstealervmprotect

  • Detects DonutLoader

    loader

  • Detects Vidar Stealer

    stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Family: WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Vidar Stealer

    stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1