Extracted

• • Target

    d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118

  • Size

    566KB

  • MD5

    d08dd66ae0730f1a09c753d34e1df3d5

  • SHA1

    89bd1a89f887707bf85ce29a3ec4fd652333a8a6

  • SHA256

    1b9ddb40b3935d58544774f7c6b7e95343be5dc0a8bf98b3105163a5afbb8c65

  • SHA512

    ff14a6b9229be571421a22f963b5a644df9fdc85306d1dc2565c2fad603be8d1dfecf48e613c8ce1b6801486dd320d6c8584e8f85640b2d1e441820f09ee5d27

  • SSDEEP

    12288:US4unwmcfDB/CyofvOnAYvy4I9Mm0l0MP2mo5hnyRIAT:T4uwhRCfvOnjy4I9Mm0HcnUT

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2