Extracted

• • Target

    5a25357e1946d486c681be60578b252b_JaffaCakes118

  • Size

    322KB

  • MD5

    5a25357e1946d486c681be60578b252b

  • SHA1

    77d1b1e1a8920183f0863e6340eda0b0bb883db5

  • SHA256

    9969ddc2a9be5f780f4fcaaabb87e961f82bf99da4f031a5366e1d527ebfee29

  • SHA512

    c11f6c4ba834709bc00d5e97bd12373a25023fa23aa50aab5b7f656531358660a469b00ed2a9ca005f9cc3667a5f4d496e53bee0a13815a2e95ec8201db32bdb

  • SSDEEP

    6144:D4GSzYBenlp6VEJD6Lp478PyY3h2YDdsawz8:UGS7lp6VEt6JPRh1dHJ

  Score

  10^/10

  warzoneratagilenetinfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2