Extracted

• • Target
    62d858df93a1ef71f5ed7ed1d8111395.exe
  • Size 2.5MB
  • SHA256 4d771099702b61244d44ce4d6c6ffdacd79bfead7b5774eb0ec8a1e7e9470056
  • MD5 62d858df93a1ef71f5ed7ed1d8111395
  • SHA1 5b0e71ff65b489438ccd4cd75fed0f848259511d
  • SHA512 ccfb0456b365fc0715dc3bf39bd838b8e8e16682bfe8dcc6f450236a73fffc0d52194fb59e7603da1627cade187add46e82ac490b2ff4c32e63da33298e2b481
  • SSDEEP 12288:scOdNT8feftQC9zoGzNkcOpHWbF6fa90osMjw:hUTtMXHWcMj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  warzoneratinfostealerpersistenceratcollectionspywarestealer

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Sets DLL path for service in the registry

    persistence

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2