Extracted

• • Target

    ee30419ed7499c224dded63416f5e70f_JaffaCakes118

  • Size

    849KB

  • MD5

    ee30419ed7499c224dded63416f5e70f

  • SHA1

    85519bf70e7e05c7f3d74dc38154934834f0cca2

  • SHA256

    b09ba0422073d096874e13104b4709f379468dd324eb85dcb84cd112a6609f1b

  • SHA512

    2c4c8f85486d155b09468a1dd773d6928f1885fb9d04e34918ce3612a92e242b2d407f263bba538df19b75160594e8e7389b5e16b68923c26e2cc78a321c4a64

  • SSDEEP

    24576:ymMTGeriBlWM0oSyEboy970e+y2/Vb0Amexia:9MTGeriBlWM0oSyEboy970e+y2/Vb0AZ

  Score

  10^/10

  warzoneratdiscoveryexecutioninfostealerpersistencerat

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2