Extracted

• • Target

    9561579da864bdc5689b7558d50566fe_JaffaCakes118

  • Size

    103KB

  • MD5

    9561579da864bdc5689b7558d50566fe

  • SHA1

    09cb246addd6a9e074d3df4e0f18c35daf1830c3

  • SHA256

    0cd55368015583bc52cacfb50df9b204e0472bed7808e13759031fbf095a48a3

  • SHA512

    84c4c78d991c2af711e38014d1213621843306ba129acf5e0aac02e1f2cf20a167466b2ec90f266f48520cd49d892e667d24a1d58bc4b2228313039775cd4ff2

  • SSDEEP

    1536:HX90TZBqR1xryR+1R3//9sKGDYbsPs12eSgcvNucKBiLmXjZELXmbXQJc2:HqusRo//SKHbas12eSNQGmXt0QXQJc

  Score

  10^/10

  warzoneratinfostealerratupx

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2