Extracted

• • Target

    1ff9b1f3cce75540c7a5f664822a7fa5_JaffaCakes118

  • Size

    284KB

  • MD5

    1ff9b1f3cce75540c7a5f664822a7fa5

  • SHA1

    17e3060ca811708a53ba2bcb1e64b1c1ad1b9377

  • SHA256

    79cb1ad7f322fcbe1d6d40a6e6604e9546d12a342824edb5290ef83d043d1065

  • SHA512

    4175bca8d1d79c54bfd1df38b3a16d8d2cf39a3ef2434871600e0bd122206f1cb5d941f353accea7ac67b9172a9d721db149e0e3289925c39d721e92a750ff43

  • SSDEEP

    6144:3lAcPLOpOym0A6RzqMmpAmYD0pJH4eC3ALv1Dc+:V5PCsLAzqimY4pJYe2A5Q+

  Score

  10^/10

  warzoneratinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2