General
-
Target
fa39a305180ccfd7fe227d94f463f900_JaffaCakes118
-
Size
1.3MB
-
Sample
240419-nv4araaf94
-
MD5
fa39a305180ccfd7fe227d94f463f900
-
SHA1
a97c990b46b5ff05b46dc6778a6f79b92c2618d8
-
SHA256
3e6e256f7b7d79667eceba8888a26457124a33e09adc8d4bb8bc883335acd4b0
-
SHA512
4fee67879b3fcb4ec4f16c52dd7d5b87618e4f8af61bc2517062e8a31124ad18b2ac6f7a095bfeafb0d09ad22d4294d856d453dd22b585c32bbb27a5605cbbf0
-
SSDEEP
6144:yFiODSVo8MrfuwkDvRBFyV9tDH6VdIa3aLHbufFrXj+SRrhW+QE5jUQyygegclqR:yswSGF2w3EzxBlK
Static task
static1
Behavioral task
behavioral1
Sample
fa39a305180ccfd7fe227d94f463f900_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fa39a305180ccfd7fe227d94f463f900_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
warzonerat
akwz.mypets.ws:2849
Targets
-
-
Target
fa39a305180ccfd7fe227d94f463f900_JaffaCakes118
-
Size
1.3MB
-
MD5
fa39a305180ccfd7fe227d94f463f900
-
SHA1
a97c990b46b5ff05b46dc6778a6f79b92c2618d8
-
SHA256
3e6e256f7b7d79667eceba8888a26457124a33e09adc8d4bb8bc883335acd4b0
-
SHA512
4fee67879b3fcb4ec4f16c52dd7d5b87618e4f8af61bc2517062e8a31124ad18b2ac6f7a095bfeafb0d09ad22d4294d856d453dd22b585c32bbb27a5605cbbf0
-
SSDEEP
6144:yFiODSVo8MrfuwkDvRBFyV9tDH6VdIa3aLHbufFrXj+SRrhW+QE5jUQyygegclqR:yswSGF2w3EzxBlK
Score10/10-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-