Extracted

• • Target

    ec2453dbb46e27680ce11ee4d08137e0_JaffaCakes118

  • Size

    212KB

  • MD5

    ec2453dbb46e27680ce11ee4d08137e0

  • SHA1

    2831bdbbfc67cb405a2231ca7195f4040ee20d60

  • SHA256

    0214d1d58efc92256a064dd0a0d0a58c66f576eb260812dbd4905fdde0011dc6

  • SHA512

    1f2941be38a9fa7aaec3ad8e64b2c90074d6f4d2fad60a4377597ca422c29c4a49881b1cea598eacb3e41bda25cab616dbf659db99ad728afa89282e75495519

  • SSDEEP

    3072:YLca+56U04VjKkXzpicDlsc3w5zaLjBet8AbWF:fjKkXzpicDGc0kBkA

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistenceratrezer0upx

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • ReZer0 packer

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0

  • Warzone RAT payload

    rat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1