Extracted

• • Target

    1f852ea376663807f62403aa7f3e2706_JaffaCakes118

  • Size

    829KB

  • MD5

    1f852ea376663807f62403aa7f3e2706

  • SHA1

    17160abf5dddab1ab19fa5c714ed582e3f3dee27

  • SHA256

    92cb920a179ba20d60097dbde4cf0509c16b5fb76cc10c814678acf3484844cd

  • SHA512

    a810fd7eb4907efdad5db2501a0f1212ee48ca0ec27808937866c0a0e5fdb11e74d8c3a7d70826aef891a78da7640f496fe46a3511ad9ced9fcaf644169fa350

  • SSDEEP

    12288:3p2cqiK+Kr8PNjpKJjqo5TQZyf7SBNiQb05gQMhMLhOj0qtOS/d82:3tQ7sNkj5Iig1abOX

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2