Extracted

• • Target

    082a7fff10d7c33b748225adab7d6053_JaffaCakes118

  • Size

    369KB

  • MD5

    082a7fff10d7c33b748225adab7d6053

  • SHA1

    603af39d13874dc0b64712d28095174db2b59bd5

  • SHA256

    546dcac6a5fc155afcc19a4b74effff13414636362129cdbe73d47e994dc39b4

  • SHA512

    8b96f6515faef66883d369b654a1a6f1d6384a309f701b455586ffa9829fcbda850e8500017eb8cb0697c4cd156d0da5f3acc7836d98b36a3fc82050280c5c66

  • SSDEEP

    6144:lI7mF3BnciAtk8Ab2TVsrl2mI05J5heZHFmwnlyDBWsdeKtyD21:bqazbTrl2mI05JuHMCl8v

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2