Extracted

• • Target

    b1659ed1bf926a3475451691669bba84_JaffaCakes118

  • Size

    491KB

  • MD5

    b1659ed1bf926a3475451691669bba84

  • SHA1

    1693e8a27a4a24ee628b7057a2601dcf199b0c19

  • SHA256

    d3a840abca16ffa15d2428cf184efa209b4555c58f8cff12e718da228fa6878a

  • SHA512

    8b6d9ac80c1ba75db47c938082276007575ca61801fc613954a8b193e0fed708571641fd18033c2ad1b16bc6d4e29c0bcc4d64ab6a702b7b1a3fd02c38dde703

  • SSDEEP

    6144:ubtS0ERQ+3HwODecEqbUbCTOska7EeeNWYXo/6Ms1boxDDwyLDs5o30:uHESoSczbUb8kkWXXGlsgwCcoE

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2