Extracted

• • Target

    f672d1603b04f6a1bb2c1168429768de_JaffaCakes118

  • Size

    409KB

  • MD5

    f672d1603b04f6a1bb2c1168429768de

  • SHA1

    7321c9d98b08b4e2a59240666a17787d583e74f0

  • SHA256

    d267c57b4520dcb86c9930857aef0d59457c832b820a3a4c568c63ffe2837165

  • SHA512

    21bff6aea5afa8f983ce920f8d0b4774173ccd065dd44f01e03d31fba5bb706c6e1b7cc6e5ef4394724e539f2c4842ee13f64e182dae72a700ef08d9f33e6575

  • SSDEEP

    12288:L2LfajrFOnz+EtLLz7YVWy+OPWejt/pTwQqXPU:L2Lmw+EtYVR1Fjt/pTwQqs

  Score

  10^/10

  warzoneratinfostealerpersistenceratupx

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2