General
-
Target
655f0656e49f279b523df95033b25dbf_JaffaCakes118
-
Size
1.7MB
-
Sample
240522-aylyzseh55
-
MD5
655f0656e49f279b523df95033b25dbf
-
SHA1
8e80aba7262ed142fbe2b13a96605742fc9765c1
-
SHA256
02a3ceb7d6cee34f757b010560d78195fb712de8a6eeba23c6dc0263925a939d
-
SHA512
05b0156edb92d3b98765439c56df0d5c5627ea69ae1b4b338797e07e96f268c8b139ec3244e99e96753e54b762be7d48ecbd13d7c72717105c7a4ca5e780c6c8
-
SSDEEP
6144:tS7ErGlSI2izLoZKhb1xhfyC55nuvYxRRAOhVxPdeCiy:U7EalzzLSKhxvf/nuvYxRRLgLy
Static task
static1
Behavioral task
behavioral1
Sample
655f0656e49f279b523df95033b25dbf_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
655f0656e49f279b523df95033b25dbf_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
warzonerat
79.134.225.86:5200
Targets
-
-
Target
655f0656e49f279b523df95033b25dbf_JaffaCakes118
-
Size
1.7MB
-
MD5
655f0656e49f279b523df95033b25dbf
-
SHA1
8e80aba7262ed142fbe2b13a96605742fc9765c1
-
SHA256
02a3ceb7d6cee34f757b010560d78195fb712de8a6eeba23c6dc0263925a939d
-
SHA512
05b0156edb92d3b98765439c56df0d5c5627ea69ae1b4b338797e07e96f268c8b139ec3244e99e96753e54b762be7d48ecbd13d7c72717105c7a4ca5e780c6c8
-
SSDEEP
6144:tS7ErGlSI2izLoZKhb1xhfyC55nuvYxRRAOhVxPdeCiy:U7EalzzLSKhxvf/nuvYxRRLgLy
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-