Extracted

• • Target

    1d567410aef049362058e077fed717b0_JaffaCakes118

  • Size

    656KB

  • MD5

    1d567410aef049362058e077fed717b0

  • SHA1

    fefd561a5a19ac75e0f2a2c7b1fa4517ad6e16f8

  • SHA256

    33568c503537a0e4e8735690c59bd4636453227e27eae6cfbc08dc2f6b9df921

  • SHA512

    c033d3cf3ebde4a7b84943153e06101faa1db8e5e4d8d601397f6fe2be05c9467960075cdede2a4f610251eb0367c3c949f9cd2cc9c14cbf522a41dbeb32059e

  • SSDEEP

    12288:ZFX3TJwh9BfrYDgtIKZ/ZhVNFXOGLhFb/yM0WeXyBxkjAt:7TeLkoZnNF

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2