Extracted

• • Target

    8c8b127c6f948db9811f6e00dba09a27_JaffaCakes118

  • Size

    1.1MB

  • MD5

    8c8b127c6f948db9811f6e00dba09a27

  • SHA1

    b336366fabbee7cdadce960eff3f40b89620289d

  • SHA256

    735d695f63f23b5bbe9e2cb7e38f999a360b3b343876ac144f2fe6972a0dae8e

  • SHA512

    cb4296940ef6386706f1e875a6988f06ddb020056b3ada640014f7a49fc5e54959d1f1c3db65b4242597f3839d8ed7e8b1a15663a7314b51cbd63e4af10ebf42

  • SSDEEP

    24576:jJe+AAZ6AQDyduS6vIDBiCcQn7YzgbGxSbjDd:jJ8AQGl6gDzB0xsjD

  Score

  10^/10

  warzoneratinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2