Extracted

• • Target

    d67910879642b78fbb5e49b2c8e89603_JaffaCakes118

  • Size

    771KB

  • MD5

    d67910879642b78fbb5e49b2c8e89603

  • SHA1

    c37032eb9f9e1ec463c40c1bba4d2d1ac0a66be9

  • SHA256

    07c9e053c40021df38aa0f37a4848da6cd8e2856262cf67c8419100968a7cca1

  • SHA512

    f9e223317a9acf185958e0e7cf783b58a5e805309061740c6c1c428fc45ce02acd2f3c735471b8c874cac98098db4a5174a8e332dd549d22b346b4378e544a26

  • SSDEEP

    12288:j6YdEQV5Je0n2yuBZlS5y+9+MUbM6ZDSRiovHH9goiPeq+8mMtP:L1pn2Nu5J+MUb/ZDMx9wPeq+8myP

  Score

  10^/10

  warzoneratdiscoveryinfostealerrat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2