Extracted

• • Target

    3f48755a19953e9c0e5e4b7436086e3e_JaffaCakes118

  • Size

    858KB

  • MD5

    3f48755a19953e9c0e5e4b7436086e3e

  • SHA1

    6eebacf37d21aaa8b808fff8fcc97ebdd62915c3

  • SHA256

    cda918fabf2f34622ac937e0b97b218217255d3c380dd5ee630e386fd0920ac3

  • SHA512

    53a3c86c611452fa9fcef8ba7b33b8899e5e0fbbddf80dba66a26c0da062a2d0b704d4d7a18fadde55e9f8c594d6649988012e55157ca8095f00dcf68c67fcbf

  • SSDEEP

    24576:uFFq+b5j65eH6Q2as94X4KzDkJkdvQmwzOP:jeaQ2Jo

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2