Extracted

• • Target
    PO - Drawings And Specifications Sheet^PDF.scr
  • Size 25KB
  • SHA256 6c50f2ce4c1837beeeae5f03ae740dc759955eabb63ef41bda72bc89312657c8
  • MD5 b27ee7349c08645d7d9d273091747369
  • SHA1 4b9b13703db022cd2b5cc08e01725efe79f2d342
  • SHA512 aaf99d0db2e8e5b52160f149588e03a7ef6ca33a4973c1be66d309505dfdeb4ae34772072c88dac8439efe7f2037c308dd541db97550e699d78c2bcace9628b0
  • MD5 SHA1 SHA512

  Score

  10^/10

  warzoneratcollectioninfostealerpersistenceratspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2