Extracted

• • Target

    f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118

  • Size

    454KB

  • MD5

    f44c5ee427e17ec6ca2cca529dac4960

  • SHA1

    057f34c7f586cb3ad5c6ac5bac85e10dc1b7c1a3

  • SHA256

    19208770999143f57876f067c6b8d4e6095c54f325b7ff7a0876972dd9239a07

  • SHA512

    5e383990ff8f970b6b7d0f7ff6d61df6135a26730d36b8498d9b13bf2f489d303db63d15c7e6049b0da5538cf62f373c0af6d27f05257da1e466a9c878fe4dfd

  • SSDEEP

    12288:p5BbwrSx/ZzLXbtsnNCAoVR/cPIVmXh0H7:p5Bbwrk/ZzLLtsnN6Wu

  Score

  10^/10

  warzoneratdiscoveryinfostealerpersistencerat

  • Modifies WinLogon for persistence

    persistence

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • Warzone RAT payload

    rat

  • Suspicious use of SetThreadContext

  behavioral1behavioral2