Extracted

• • Target

    f1831646a449684fc0787d08e147017d_JaffaCakes118

  • Size

    447KB

  • MD5

    f1831646a449684fc0787d08e147017d

  • SHA1

    e91efbd06b85b297db166d39c8dc18f7e7aa8365

  • SHA256

    49bd52161ac80de23fde0851abc834f81e1765eb55880a04a7bec010616b1957

  • SHA512

    c82eacbb11919f64523e791f65094a01b5258539a9078ff56fb057c6ef46ba98e26530c217c8c4f921691a51e28ea597992b62c4c056782da54f8fa8be3dffe1

  • SSDEEP

    12288:DrQ2L1yXGK6ARkSetsRFPgRfhKFvExxLo7W:DDxASXSRFPg1EBExu

  Score

  10^/10

  warzoneratzgratinfostealerrat

  • Detect ZGRat V1

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2