Extracted

• • Target

    c044e89e4ddb784d57b4f666f5c4494b_JaffaCakes118

  • Size

    703KB

  • MD5

    c044e89e4ddb784d57b4f666f5c4494b

  • SHA1

    560103007239f9f0a67294ba066c4e17d11722f3

  • SHA256

    52e47dec2ccc537f6ee84e42adedc766122357ec39ec90e93141d36f6e82ab05

  • SHA512

    a95047a8067020fcdbd40681cdcfe34672c21781b05693769ac66e975a887fcea33bc31c6105ca6abd86136f466925f7aa84cb50ce7b7cd098fcbbe2a95063d3

  • SSDEEP

    12288:Dsq4z4TEt7xdY+8XKEyx/Mt9tEC1K7nUmSiU/kJiyEKJpJVDt+Zmbap7lJfkHheO:DAQijaw1qwC1UUmP5n

  Score

  10^/10

  warzoneratdiscoveryinfostealerrattrojan

  • Detects BazaLoader malware

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests - JaffaCakes118.

    trojan

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2